2026-08-26_f59e10efde39b3c45c71c1c6cb1224a1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

General

Target
2026-08-26_f59e10efde39b3c45c71c1c6cb1224a1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 35.4MB
Sample260827-cl2vsayeqg
SHA256 6dd67419fa627282eb1a0c04f95f8bea8a6bb2e6961dabd8440c2b26027af5f8
MD5 f59e10efde39b3c45c71c1c6cb1224a1
SHA1 226d0640630445bb4103c3a85ac33d4bd50e791e
SHA512 11df0c91c7aa1be1c63dd0ffa057eaac12073590fe85ec78e04f08b7b8fb2627e39a48b28b28068912a7d433a4099d51159e3f370fc75e598e64337ea9816a55
SSDEEP 196608:ltSOOOOO+OOOOOHOOOOO/OOOOOGOOOOO/OOOOO+OOOOOfOOOOOTOOOOOuOOOOOrF:l2
TLSH
T1A0878D7C1F4F89CFA5D0E4680DA4FEAD5FCB20785433C601C762129679E4EA4AEE21D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-26_f59e10efde39b3c45c71c1c6cb1224a1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-26_f59e10efde39b3c45c71c1c6cb1224a1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 35.4MB

2026-08-26_f59e10efde39b3c45c71c1c6cb1224a1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH 02f80af79b0b114acf355f0695370fe5
SHA256 6dd67419fa627282eb1a0c04f95f8bea8a6bb2e6961dabd8440c2b26027af5f8
MD5 f59e10efde39b3c45c71c1c6cb1224a1
SHA1 226d0640630445bb4103c3a85ac33d4bd50e791e
SHA512 11df0c91c7aa1be1c63dd0ffa057eaac12073590fe85ec78e04f08b7b8fb2627e39a48b28b28068912a7d433a4099d51159e3f370fc75e598e64337ea9816a55
SSDEEP 196608:ltSOOOOO+OOOOOHOOOOO/OOOOOGOOOOO/OOOOO+OOOOOfOOOOOTOOOOOuOOOOOrF:l2
TLSH
T1A0878D7C1F4F89CFA5D0E4680DA4FEAD5FCB20785433C601C762129679E4EA4AEE21D6
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a8:cd:2d:b5:b6:03:d2:83:ff:13:80:2f:19:b8:3a:28:98:f1:dc:94:56:91:d6:b1:26:61:e2:01:27:3f:a1:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Aug 26, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

PE Signature issue

Digest

81:14:7e:fc:60:fb:33:ce:2e:6f:c5:69:b8:13:27:16:28:2b:dc:42

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Aug 26, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Minor OS version

0

Major OS version

6

Entry point

29388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

IsProcessorFeaturePresent WriteConsoleW HeapSize DeleteFileW GetProcAddress GetModuleHandleA FindFirstFileExW GetOEMCP LoadLibraryA FreeLibrary InitializeCriticalSectionAndSpinCount GetLastError SizeofResource FindResourceA FormatMessageW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetACP IsValidCodePage FindNextFileW FindClose GetTimeZoneInformation GetFullPathNameW GetCurrentDirectoryW GetFileAttributesExW WideCharToMultiByte MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlUnwind CloseHandle SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateFileW GetFileType ExitProcess GetModuleHandleExW ReadFile GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapFree HeapAlloc FlushFileBuffers GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetStdHandle SetEndOfFile

user32

LoadStringA

Name

.text

Size

776KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

34.4MB

Virtual Size

34.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-26_f59e10efde39b3c45c71c1c6cb1224a1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

PE Signature issue

PE Signature issue

kernel32

user32

generic