2026-08-01_a35c9a62efd566bca22cc66e075791e0_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_a35c9a62efd566bca22cc66e075791e0_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc
Size 5.3MB
Sample260801-qdqpfaba94
SHA256 e4a372c0a121df16dca9102035cb263004bf576938a1ab61857640c453106930
MD5 a35c9a62efd566bca22cc66e075791e0
SHA1 40d19445d0c40e14497d81362efe3f4129cefce5
SHA512 ac1d99bdff469f3bf066ef4737fb9f2848173f863f82601a03e703414369aa5692cbfa28a0eaf820d10d23d62381e624b4312027879f2faaf32a637f375755ec
SSDEEP 98304:yPSK4HmxAzLm2zsJV3cHT5q2dwYj+uk86BwhjFuua:yPxklAjN2swhYp
TLSH
T199468D43F2E664BCCA16C174930BA773F9357C490321ADAB46D4AB303EB69506F2EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-01_a35c9a62efd566bca22cc66e075791e0_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

.exe 5.3MB

2026-08-01_a35c9a62efd566bca22cc66e075791e0_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

IMPHASH 1ba8c12a3c6f4eb92be6d699100faca1
SHA256 e4a372c0a121df16dca9102035cb263004bf576938a1ab61857640c453106930
MD5 a35c9a62efd566bca22cc66e075791e0
SHA1 40d19445d0c40e14497d81362efe3f4129cefce5
SHA512 ac1d99bdff469f3bf066ef4737fb9f2848173f863f82601a03e703414369aa5692cbfa28a0eaf820d10d23d62381e624b4312027879f2faaf32a637f375755ec
SSDEEP 98304:yPSK4HmxAzLm2zsJV3cHT5q2dwYj+uk86BwhjFuua:yPxklAjN2swhYp
TLSH
T199468D43F2E664BCCA16C174930BA773F9357C490321ADAB46D4AB303EB69506F2EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

6d:f7:e2:7a:06:a3:5a:76:e3:30:ae:1e:ee:20:f0:26:69:7e:78:8e:5f:7e:9e:00:51:1a:49:a1:c8:93:08:7e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Chains

Jul 31, 2026

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Davydov Egor Denisovich,O=IP Davydov Egor Denisovich,L=Penza,ST=Penza Oblast,C=RU,1.2.840.113549.1.9.1=#0c15706f7263686573313333374070726f746f6e2e6d65

Serial Number

22:a3:64:90:5c:11:f8:26:73:bc:a4:dd

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 23, 2026 - Mar 24, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

3886068

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle ControlService CreateProcessWithTokenW CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext EnumServicesStatusExA EventRegister EventSetInformation EventUnregister EventWriteTransfer GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExW RegDeleteTreeA RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtClose RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind VerSetConditionMask

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringEx CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcessModulesEx K32GetModuleBaseNameA LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetWindowRect IsWindowUnicode LoadCursorA LoadIconA MessageBoxA MonitorFromWindow OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClassLongPtrA SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetProcessDPIAware SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow WaitForInputIdle

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteA ShellExecuteW

ole32

CoInitializeEx CoTaskMemFree StringFromGUID2

shlwapi

PathCanonicalizeW

dbghelp

SymCleanup SymFromAddr SymFromName SymGetLineFromAddr64 SymGetOptions SymInitialize SymInitializeW SymLoadModuleExW SymSetOptions

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CertOpenStore CertOpenSystemStoreA CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryW PFXImportCertStore

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptGenRandom

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

50B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_a35c9a62efd566bca22cc66e075791e0_cobalt-strike_coinminer_glassworm_icedid_njrat_quasar-rat_remcos_ryuk_stealc

advapi32

d3d11

ntdll

ws2_32

kernel32

user32

shell32

ole32

shlwapi

dbghelp

gdi32

crypt32

imm32

d3dcompiler_47

dwmapi

bcrypt

generic