2026-08-08_6c87d93fccec1c830ed7a0e4fc1e297a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_6c87d93fccec1c830ed7a0e4fc1e297a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
Size 3.3MB
Sample260808-dy66psyhkc
SHA256 f80941eb79613e8e5731f73c0a216b2b651464d49c3225c1c40d75d77a7b9aa4
MD5 6c87d93fccec1c830ed7a0e4fc1e297a
SHA1 117c6154e6fd44e3ca8aceb6eb217ea31948f180
SHA512 be6e4effd7ff55195c931525a84dc1bc4b5de48eb2190f06865134cfe68485761f1f2a3dfa10aff4773fade791b4d2c67b83a4f1afdac3a92eb7627237b074a5
SSDEEP 49152:BFMzty3VOzwsXv9v+rV3ajrrbkAcOepNwL402AY45PxOn+s1OFmP/EUPE6:qIFOpc6bkxOooYbmL6
TLSH
T12BF57D96BBA401D8D86AD23CC4564607E7F1BC255B7097CF1A682ABA1F33BD51E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-08_6c87d93fccec1c830ed7a0e4fc1e297a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 3.3MB

2026-08-08_6c87d93fccec1c830ed7a0e4fc1e297a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH db984eb0135e4be45b9581a3af706870
SHA256 f80941eb79613e8e5731f73c0a216b2b651464d49c3225c1c40d75d77a7b9aa4
MD5 6c87d93fccec1c830ed7a0e4fc1e297a
SHA1 117c6154e6fd44e3ca8aceb6eb217ea31948f180
SHA512 be6e4effd7ff55195c931525a84dc1bc4b5de48eb2190f06865134cfe68485761f1f2a3dfa10aff4773fade791b4d2c67b83a4f1afdac3a92eb7627237b074a5
SSDEEP 49152:BFMzty3VOzwsXv9v+rV3ajrrbkAcOepNwL402AY45PxOn+s1OFmP/EUPE6:qIFOpc6bkxOooYbmL6
TLSH
T12BF57D96BBA401D8D86AD23CC4564607E7F1BC255B7097CF1A682ABA1F33BD51E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

5d:4f:36:9f:9c:43:71:6e:35:24:09:09:62:9d:38:d5:5d:c9:4d:a3:1e:01:ed:d0:80:76:c7:65:39:29:46:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Chains

Jul 9, 2026

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Serial Number

24:bb:11:9c:e7:e7:1d:59:89:e0:c6:f6

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2025 - Oct 9, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1909620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Webhost\10-07-2026\WindowsBuilds\UEMS_CONFIGURATIONS\13942762\uems_config\Native_Src\native\ONPR_x64\dctask64.pdb

mpr

WNetAddConnection2W

msi

ord88 ord169 ord141 ord224

ws2_32

shutdown socket setsockopt connect recvfrom sendto getservbyname getservbyport gethostbyaddr htons htonl select ntohs getsockopt getsockname ioctlsocket WSASetLastError send recv getpeername inet_addr inet_ntoa closesocket gethostbyname getnameinfo WSAGetLastError WSAStartup

crypt32

CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CryptMsgClose CertCloseStore CertFreeCertificateContext CertOpenSystemStoreW CryptEncodeObjectEx CryptMsgOpenToDecode CryptMsgUpdate CryptGetMessageCertificates CryptQueryObject

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateHeader ImageGetCertificateData

kernel32

WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx GetFileSizeEx GetConsoleOutputCP CreatePipe EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA CreateFileA FindClose ReadFile WriteFile DecodePointer CloseHandle GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetSystemTime GetModuleHandleW GetProcAddress SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW SetFilePointer WaitForSingleObject TerminateProcess GetExitCodeProcess GetCurrentDirectoryA GetCurrentProcess OpenProcess VirtualAllocEx WriteProcessMemory FindResourceExW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW LocalFree FormatMessageA SetConsoleOutputCP CreateFileW GetCurrentProcessId CreateThread FreeLibrary LoadLibraryA QueryFullProcessImageNameA GetCurrentThreadId FileTimeToSystemTime SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType GetEnvironmentVariableW GetACP GetStdHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetSystemDirectoryA GetConsoleMode SetConsoleMode ReadConsoleA RtlUnwind GetSystemTimeAsFileTime FindFirstFileW FindNextFileW PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler SetStdHandle GetModuleHandleExW ExitProcess CreateProcessW DuplicateHandle LoadLibraryExW CreateRemoteThread ReadConsoleW GetStringTypeW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW QueryPerformanceCounter FlushFileBuffers SetEndOfFile FormatMessageW InitializeCriticalSectionAndSpinCount GetModuleFileNameW SetEnvironmentVariableW RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxW

advapi32

RegOpenKeyExA CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegQueryValueExW LogonUserW OpenProcessToken CreateProcessAsUserW RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_6c87d93fccec1c830ed7a0e4fc1e297a_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

mpr

msi

ws2_32

crypt32

wintrust

imagehlp

kernel32

user32

advapi32

generic