2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

General

Target
2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
Size 7.8MB
Sample260730-v9ygdatekh
SHA256 c37d5ffed0d3701c794cd3b660a55d42e24ed330585831b5ab0a782bb981a707
MD5 5582fff8a24b3ec87f75abfa2272e0d9
SHA1 bdfa339b71646461557ed1833b39175a857b730b
SHA512 64e8278efc8b3c77bcdb23a5a02c60bd8f0995e1633d15497691ace1c43a4582efae13eb2663d7e69338416639246f254e5584a0902c2a8a15f6b3700bd61d25
SSDEEP 98304:pF+FrNL4TlyNLjZ44tko0xdrkGSHKafsHK+23Ww1j4DO8ZQoovaPifAEC/m8qRJ5:j2rN8TINLjZ+7fui5O8saAAEucf
TLSH
T19586AF47A3E801ECD0BBC13C89569613E7B2B85513709BCF16A1867A5F63AF25E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 7.8MB

2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH b1d3ffd985b3fc8710cf0afade8091f5
SHA256 c37d5ffed0d3701c794cd3b660a55d42e24ed330585831b5ab0a782bb981a707
MD5 5582fff8a24b3ec87f75abfa2272e0d9
SHA1 bdfa339b71646461557ed1833b39175a857b730b
SHA512 64e8278efc8b3c77bcdb23a5a02c60bd8f0995e1633d15497691ace1c43a4582efae13eb2663d7e69338416639246f254e5584a0902c2a8a15f6b3700bd61d25
SSDEEP 98304:pF+FrNL4TlyNLjZ44tko0xdrkGSHKafsHK+23Ww1j4DO8ZQoovaPifAEC/m8qRJ5:j2rN8TINLjZ+7fui5O8saAAEucf
TLSH
T19586AF47A3E801ECD0BBC13C89569613E7B2B85513709BCF16A1867A5F63AF25E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

3724256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\rc_v12_Off_i18_plu_260508\Build\Release_x64\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

GetCommandLineW SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW GetWindowsDirectoryW FindResourceExW FreeLibrary GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource SetDefaultDllDirectories FindResourceW LoadLibraryW SetDllDirectoryW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount GetModuleHandleW VerSetConditionMask ExpandEnvironmentStringsA CreateDirectoryW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetShortPathNameW GetTempFileNameW GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetVersionExW ReadProcessMemory GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW GetTimeZoneInformation GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetNativeSystemInfo GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree CreateFileW GetFileAttributesW GetFileSizeEx GetCurrentThreadId GetProcessId GlobalMemoryStatusEx GetFileInformationByHandle GetFileSize ReadFile SetFilePointer WriteFile GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc ExitProcess FreeResource DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread ExpandEnvironmentStringsW ProcessIdToSessionId GetEnvironmentVariableW CreateProcessW GetLongPathNameW GetFileAttributesExW SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW OutputDebugStringW GetProcessTimes GetStdHandle GetFileType RtlVirtualUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe InitializeConditionVariable WakeAllConditionVariable CreateEventA RegisterWaitForSingleObject UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock SetFileTime DuplicateHandle DosDateTimeToFileTime HeapCreate GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx AreFileApisANSI MoveFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler WriteConsoleW GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW RtlUnwind

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

584KB

Virtual Size

583KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_5582fff8a24b3ec87f75abfa2272e0d9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

kernel32

generic