2026-07-22_b6ecdcce6d14c7a30a0f144093f1b356_coinminer_dcrat_elex_glassworm_icedid_njrat_stealc

resource	yara_rule
static1/unpack001/cuoreui.dll	INDICATOR_EXE_Packed_Fody

resource	yara_rule
sample	INDICATOR_EXE_Packed_DotNetReactor

resource	yara_rule
sample	net_reactor

resource	yara_rule
sample	costura
static1/unpack001/cuoreui.dll	costura

resource
2026-07-22_b6ecdcce6d14c7a30a0f144093f1b356_coinminer_dcrat_elex_glassworm_icedid_njrat_stealc
unpack001/costura.dll
unpack001/cuoreui.dll

resource
unpack001/guna.ui2.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 eb0a8cfb9f8ddd2251f40dee8d69e1a971a885c4d396c797ef4375d6d7e204ca
MD5 b6ecdcce6d14c7a30a0f144093f1b356
SHA1 3f5113864eb5717a8a71e1cb87c75125a920ef93
SHA512 5f3ec7645678779a898e244dc1080b35826d36a4a637334bb84d571ee3959209e130bee7a37e12d113b6eeab7e5cde20c0aaa11c86d2cccfe8046c33f2f6755f
SSDEEP 393216:NqRptO2uyOuNvy7H4nZBIVK65EVKKCGF35DhDLu+rwuedNe5PZkztkHXT:NYtPza05NuPMWsXT
TLSH
T19C57D05966B5919CD25BC078D3535B12EB2270A403606FFB11B9CAB02FA3FE01E7D762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with unregistered version of .NET Reactor
.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28642734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

AlpacaBypass.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with unregistered version of .NET Reactor
.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
MD5 dd3394a0ba6f7158d029e1c3a31b7a85
SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
TLSH
T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with unregistered version of .NET Reactor
.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cuoreui.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 488a5c32241fe5f76e4c44a9aef1e20cb61995303ac9dfdb24ddbe30ee95594b
MD5 3036b701a2c553da3447e02492c7e29f
SHA1 34c9d970b97f254faeaf7e3430121a2587473c74
SHA512 91a481609ca30bd2e7e86361f8bf56866689f711169d48e777aa1065dc3d1ad956f0730483b2a11051abb9bdbade115c0e417b1897887338659279820cb021f5
SSDEEP 6144:OIcsFiQKm20zFrsRZwhC7UFmL4c6/M4pUsuJGOW8z/QafxGERONgjFeDgrJ38mnY:hjKGhww87+tU7sXOz/RfxygrJ3F43
TLSH
T19DC4AF30231C9D2AD57E0779901B9AD2C7F2950B7369D79C8F81D0EC2ED2B266276393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with unregistered version of .NET Reactor
.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

565342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ad0ba156fcd20c5c06b173e5af8b16aeaffbae06fce9771b35974e4700c7952
MD5 f1d04f21d43efa8b2819ef86a48c1811
SHA1 f2deac990818bb151966950a665f49e681498533
SHA512 2987b7be6be37f3ab02225c284d2e0140550793a3943002a42e53ae4cb547e78cdc2fc588145b1d871b619cbb96b3047eb8b76a014385e141608a40c7ca9b55f
SSDEEP 24576:YtmmRH02jXmJyezxrqwEZLBhMVMQW/R5IZoTqVumG8WIsodFldtYzJMDnZoFF9H5:YEvKiV7rk1FFz
TLSH
T19EA509183DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66E3576C18427857C867AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with unregistered version of .NET Reactor
.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

89:6f:ae:23:a2:b3:09:9e:91:db:05:6f:49:2c:6c:50:19:d6:cb:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

2196462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with unregistered version of .NET Reactor
.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

08:39:56:e4:21:43:4f:90:03:ee:08:ba:76:09:c5:58:d4:a5:2a:73:28:78:a1:5f:f6:46:d6:59:61:a9:2a:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 16, 2025

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2024 - Nov 3, 2027

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 19, 2025

Minor OS version

0

Major OS version

4

Entry point

713798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb