privateloader | 2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar
Size 7.6MB
Sample260722-a1trlstsfy
SHA256 dc6f63eb506cab38a8bea95dddfc5f252525dfb2b720e2756941441a8ec68fab
MD5 dae047c84a12cbc3048bcbb43c9e7850
SHA1 74aeebf5be3d155e751de7e632d524ce03e32e36
SHA512 949a12721b34dfca0330e03efdf0e01455bf9185c0dd8dce2bdd780997567600f49b3c56fc34f127e4268bc56ddaf9a2bfef7b14dea50baa2bd1321eeb7f159e
SSDEEP 98304:6+mQlizx8CCRTR19CcWLMrgjplrkeunk2YisAv/XXabb4uBQV7w1:6Uli98CCRrxW5pl/uk2YisAv/XXYEq
TLSH
T19C866C1262A9D1E8E0B6D138C95645F6E2B27C19CB7097CF1690BE693F73AE05F39310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader privateloader

Malware Config

Signatures

Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

File Explorer

2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

.exe 7.6MB

2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

IMPHASH 5b99d091bc5043af5410d5c243c5a1b2
SHA256 dc6f63eb506cab38a8bea95dddfc5f252525dfb2b720e2756941441a8ec68fab
MD5 dae047c84a12cbc3048bcbb43c9e7850
SHA1 74aeebf5be3d155e751de7e632d524ce03e32e36
SHA512 949a12721b34dfca0330e03efdf0e01455bf9185c0dd8dce2bdd780997567600f49b3c56fc34f127e4268bc56ddaf9a2bfef7b14dea50baa2bd1321eeb7f159e
SSDEEP 98304:6+mQlizx8CCRTR19CcWLMrgjplrkeunk2YisAv/XXabb4uBQV7w1:6Uli98CCRrxW5pl/uk2YisAv/XXYEq
TLSH
T19C866C1262A9D1E8E0B6D138C95645F6E2B27C19CB7097CF1690BE693F73AE05F39310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3348700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\pub_18ntd\rc_bugfix_master_\Build\Release_x64\WPSOffice\wtoolex\wpsupdate.pdb

kernel32

SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW DecodePointer CloseHandle RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent CreateMutexW OpenEventW Sleep GetCurrentProcessId GetSystemDirectoryW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW GetPrivateProfileIntW CopyFileW CreateFileW DeleteFileW GetFileAttributesExW GetFileSize SetFilePointer WriteFile OutputDebugStringW ReleaseMutex WaitForSingleObject GetCurrentThreadId GetModuleFileNameW lstrlenA MultiByteToWideChar LocalFree VerSetConditionMask ExpandEnvironmentStringsW CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW GetPrivateProfileStringW MoveFileExW VerifyVersionInfoW EnterCriticalSection LeaveCriticalSection LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW GetDiskFreeSpaceExW OpenMutexW CreateEventW TerminateProcess CreateThread TerminateThread OpenProcess GetLocalTime GetTickCount FindResourceExW LockResource WritePrivateProfileStringW WideCharToMultiByte GetSystemDefaultLangID GetEnvironmentVariableW GlobalMemoryStatusEx GetNativeSystemInfo GetSystemWow64DirectoryW GetComputerNameW GetGeoInfoW GetUserGeoID GetUserDefaultLCID RtlCaptureContext SetUnhandledExceptionFilter GetCurrentProcess GetProcessId GetLongPathNameW GetExitCodeProcess ProcessIdToSessionId GetVersionExW ReadProcessMemory GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW SetLastError GetWindowsDirectoryW MulDiv lstrlenW ResetEvent WaitForMultipleObjects GlobalFree WaitNamedPipeW GetOverlappedResult CancelIo GetCurrentThread GetExitCodeThread ResumeThread MoveFileW GetDateFormatW GetTimeFormatW CreateFileA DeviceIoControl GetSystemTime SetNamedPipeHandleState InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageW GetModuleHandleExW GetStdHandle GetFileType RtlVirtualUnwind SwitchToFiber DeleteFiber CreateFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW LoadLibraryA QueryPerformanceFrequency SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LocalFileTimeToFileTime SetFileTime SystemTimeToFileTime GetSystemInfo GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FormatMessageA GetFileInformationByHandleEx EncodePointer CompareStringEx GetCPInfo LCMapStringEx GetLocaleInfoEx WaitForSingleObjectEx RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPopEntrySList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx FindFirstFileExW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileInformationByHandle SetFilePointerEx WriteConsoleW GetConsoleCP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetPrivateProfileSectionW GetUserDefaultUILanguage CreateProcessW AreFileApisANSI RtlUnwind

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

604KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_dae047c84a12cbc3048bcbb43c9e7850_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar

kernel32

generic