2026-08-18_3f8ae9edcb3a190b7a8ebebf1768e0ab_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_ryuk_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_3f8ae9edcb3a190b7a8ebebf1768e0ab_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_ryuk_stealc_vidar
Size 35.6MB
Sample260818-ctnccsthnd
SHA256 c8d777ca784fb2e49b44265b264ec535b9f313d88b28afd054d6f367ce2a70b5
MD5 3f8ae9edcb3a190b7a8ebebf1768e0ab
SHA1 961c07988a976a9db01075f9651b3989d52a09cd
SHA512 1b8cd71231ded40305f360cbba9d51e82202dafc943cd8bcc0b330b06c156e8d270bb85f885261c1e825fdf42b15d515a5218ce871f4fdbb1990de9c95102588
SSDEEP 196608:XXgss/o8HiY+t8lhYpqzWfsgipAOMfNDewy5baMIIB72ML+z8r7yB4JR4f9uF/Of:XwsYoDuYQC50wy5bkpoJR4f9uF/ONOgV
TLSH
T192876B17EA6504E9C1FDD134C6678613BB717C59073127DB3AA4A6282F37BE09EBA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

File Explorer

2026-08-18_3f8ae9edcb3a190b7a8ebebf1768e0ab_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_ryuk_stealc_vidar

.exe 35.6MB

2026-08-18_3f8ae9edcb3a190b7a8ebebf1768e0ab_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_ryuk_stealc_vidar

IMPHASH feaed039d732103702e389977d079c21
SHA256 c8d777ca784fb2e49b44265b264ec535b9f313d88b28afd054d6f367ce2a70b5
MD5 3f8ae9edcb3a190b7a8ebebf1768e0ab
SHA1 961c07988a976a9db01075f9651b3989d52a09cd
SHA512 1b8cd71231ded40305f360cbba9d51e82202dafc943cd8bcc0b330b06c156e8d270bb85f885261c1e825fdf42b15d515a5218ce871f4fdbb1990de9c95102588
SSDEEP 196608:XXgss/o8HiY+t8lhYpqzWfsgipAOMfNDewy5baMIIB72ML+z8r7yB4JR4f9uF/Of:XwsYoDuYQC50wy5bkpoJR4f9uF/ONOgV
TLSH
T192876B17EA6504E9C1FDD134C6678613BB717C59073127DB3AA4A6282F37BE09EBA700
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist

Digest

ec:65:57:58:d4:fc:b5:17:d1:dd:89:69:3a:9b:57:38:39:96:b7:8b:1c:d0:a2:0e:86:3a:91:ed:82:8a:2a:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=7647497,CN=Level Software\, Inc.,O=Level Software\, Inc.,L=Asheville,ST=North Carolina,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 11, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0d:7a:41:6a:29:36:f4:d3:ba:64:97:5e:60:ba:40:67

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 14, 2024 - Aug 13, 2027

Minor OS version

Major OS version

Entry point

12607808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject GetDeviceCaps GetObjectA SelectObject

winmm

timeBeginPeriod timeEndPeriod

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoUninitialize GetErrorInfo SetErrorInfo

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VarR8FromDec VariantClear VariantInit

user32

ClientToScreen CloseDesktop CreateWindowExA DefWindowProcA DispatchMessageA DispatchMessageW EnumDisplayMonitors EnumWindows GetClientRect GetCursorPos GetDC GetDesktopWindow GetForegroundWindow GetMessageA GetMessageW GetMonitorInfoA GetSystemMetrics GetUserObjectInformationW GetWindowLongPtrA GetWindowRect GetWindowTextA GetWindowThreadProcessId InvalidateRect IsWindow MapVirtualKeyA MessageBoxA OpenDesktopA OpenInputDesktop PeekMessageW PostMessageA PostQuitMessage PostThreadMessageW RegisterClassA ReleaseDC SendInput SetForegroundWindow SetThreadDesktop SetWinEventHook SetWindowPos ShowWindow TranslateMessage UnhookWinEvent UpdateWindow VkKeyScanA

kernel32

AcquireSRWLockExclusive AddVectoredContinueHandler AddVectoredExceptionHandler AreFileApisANSI CloseHandle CreateEventA CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateSemaphoreA CreateThread CreateWaitableTimerA CreateWaitableTimerExA CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FlsAlloc FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetErrorMode GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetModuleHandleA GetModuleHandleExW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InterlockedPushEntrySList LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException RaiseFailFastException ReadFile ReleaseSRWLockExclusive ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetProcessPriorityBoost SetThreadContext SetThreadExecutionState SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrlenA

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex longjmp memchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf fflush fgetwc fputc fputwc fwrite getc ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_isctype_l _strdup _wcsicmp isupper iswspace mbrlen memcpy_s strcmp strcpy strcspn strncmp tolower toupper wcslen

api-ms-win-crt-time-l1-1-0

_localtime64 _strftime_l _time64 clock

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l mbrtowc mbsrtowcs strtof strtol strtoul wcrtomb wcrtomb_s

Name

.text

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.2MB

Virtual Size

40.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

339KB

Virtual Size

339KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

238KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_3f8ae9edcb3a190b7a8ebebf1768e0ab_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_ryuk_stealc_vidar

gdi32

winmm

ole32

oleaut32

user32

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic