2026-08-03_ab45ed40fe6ef6955a20404ff8c7d237_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_ab45ed40fe6ef6955a20404ff8c7d237_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 23.4MB
Sample260804-mb3z7stsbt
SHA256 4ffd341dd6c3ca7a8600a71bb0bf5215a0ce06dded6c957135d5af4de6992770
MD5 ab45ed40fe6ef6955a20404ff8c7d237
SHA1 0cdd5348a70076ce78fc6b3a0adc1ba23f6b98c6
SHA512 050f675ece5ce833668fd9655d35c426f5ee97f679f628f023ba1163d21b9eb425542b9a303a3abe82a56e70718d7b52969d65c5bc3aa24430c6e86e0d88343f
SSDEEP 393216:sswja8azixnr/rLebQ1noUOlukQpL1o1pYrSQJjC1KYgpn2waUG:ijas9boJEVg1oP0j
TLSH
T1C637D0E366F994DAC17AC0BCC511B13FE723B0A64325B3D396A1E655AB13AD0B93D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_ab45ed40fe6ef6955a20404ff8c7d237_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-03_ab45ed40fe6ef6955a20404ff8c7d237_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 23.4MB

2026-08-03_ab45ed40fe6ef6955a20404ff8c7d237_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

SHA256 4ffd341dd6c3ca7a8600a71bb0bf5215a0ce06dded6c957135d5af4de6992770
MD5 ab45ed40fe6ef6955a20404ff8c7d237
SHA1 0cdd5348a70076ce78fc6b3a0adc1ba23f6b98c6
SHA512 050f675ece5ce833668fd9655d35c426f5ee97f679f628f023ba1163d21b9eb425542b9a303a3abe82a56e70718d7b52969d65c5bc3aa24430c6e86e0d88343f
SSDEEP 393216:sswja8azixnr/rLebQ1noUOlukQpL1o1pYrSQJjC1KYgpn2waUG:ijas9boJEVg1oP0j
TLSH
T1C637D0E366F994DAC17AC0BCC511B13FE723B0A64325B3D396A1E655AB13AD0B93D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16642136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

Size

3.5MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

975KB

Virtual Size

984KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

431KB

Virtual Size

492KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

219KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

54KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

36KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

10.5MB

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

7.6MB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

generic

count=21, id=259, version=29395,

count=206, id=261, version=29395,

count=6, id=261, productName=VS2017 v15.9.1 build 27023, version=27023,

count=2, id=253, version=32533,

count=20, id=260, version=32533,

count=12, id=259, version=32533,

count=99, id=261, version=32533,

count=25, id=260, version=29395,

count=2, id=123, version=2207,

count=6, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=26, id=260, version=25830,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=33, id=261, productName=VS2017 v15.3 build 25506, version=25506,

count=1, id=259, productName=VS2017 v15.3 build 25506, version=25506,

count=480, id=260, version=24231,

count=14, id=260, version=27045,

count=33, id=257, version=29395,

count=476, id=1, productName=Unmarked objects,

count=147, id=265, version=32824,

count=1, id=255, version=32824,

count=1, id=258, version=32824,