2026-08-10_130ebc2e28c2257456f300d5f243575a_cobalt-strike_coinminer_glassworm_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_130ebc2e28c2257456f300d5f243575a_cobalt-strike_coinminer_glassworm_poet-rat
Size 9.2MB
Sample260810-pnhadagb98
SHA256 5c242a7f2d9c8f9946d075a7d0be8695ba865ed54dfa1afbe6585049fa6231fd
MD5 130ebc2e28c2257456f300d5f243575a
SHA1 6c5f4c86143e9dd4a32a474fef314e36abc0a8c4
SHA512 4300891e7d33c2bfaadaa856e4db58db9780e5ceeaf9f385fef528c5c7c55fddaa987686b74938935ac212132aab681bc9be27f2dbe4430e9843e71568b02d5a
SSDEEP 98304:wD0BVOAA6b4boRH9EppqlLe1rgwBohipTsVuLIE3qEUB0zydIq6a9ZOxezc5Ov7o:wD0BVTA6b48/EPqlV6AguHD6j
TLSH
T11DA6F717F8E700EAC6BEE1748297A332BA71345983353B936F945A551B25FE07A7E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-08-10_130ebc2e28c2257456f300d5f243575a_cobalt-strike_coinminer_glassworm_poet-rat

File Explorer

2026-08-10_130ebc2e28c2257456f300d5f243575a_cobalt-strike_coinminer_glassworm_poet-rat

.exe 9.2MB

2026-08-10_130ebc2e28c2257456f300d5f243575a_cobalt-strike_coinminer_glassworm_poet-rat

IMPHASH 8b7e4e6ca8f247b095999c627c858835
SHA256 5c242a7f2d9c8f9946d075a7d0be8695ba865ed54dfa1afbe6585049fa6231fd
MD5 130ebc2e28c2257456f300d5f243575a
SHA1 6c5f4c86143e9dd4a32a474fef314e36abc0a8c4
SHA512 4300891e7d33c2bfaadaa856e4db58db9780e5ceeaf9f385fef528c5c7c55fddaa987686b74938935ac212132aab681bc9be27f2dbe4430e9843e71568b02d5a
SSDEEP 98304:wD0BVOAA6b4boRH9EppqlLe1rgwBohipTsVuLIE3qEUB0zydIq6a9ZOxezc5Ov7o:wD0BVTA6b48/EPqlV6AguHD6j
TLSH
T11DA6F717F8E700EAC6BEE1748297A332BA71345983353B936F945A551B25FE07A7E300
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

b8:e9:fd:83:7d:58:80:aa:c4:e2:44:a8:86:a2:a4:bf:0d:5e:b2:b9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=上海弘连网络科技有限公司,OU=研发部,O=上海弘连网络科技有限公司,L=Shanghai,ST=Shanghai,C=CN

Chains

Jan 22, 2018

CN=上海弘连网络科技有限公司,OU=研发部,O=上海弘连网络科技有限公司,L=Shanghai,ST=Shanghai,C=CN

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Minor OS version

Major OS version

Entry point

5376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateThread DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatus GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetTickCount GetVersionExA GetVersionExW HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter ReadFile RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetProcessPriorityBoost SetUnhandledExceptionFilter SetWaitableTimer Sleep SwitchToThread SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

__dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _cexit _errno _fmode _initterm _localtime64 _lock _onexit _unlock abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset qsort realloc signal strcmp strlen strncmp vfprintf

winmm

timeBeginPeriod timeEndPeriod

ws2_32

WSAGetOverlappedResult

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

390KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_130ebc2e28c2257456f300d5f243575a_cobalt-strike_coinminer_glassworm_poet-rat

kernel32

msvcrt

winmm

ws2_32

generic