2026-09-01_047601579dafadef8f1ec061ba2b3293_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-01_047601579dafadef8f1ec061ba2b3293_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
Size 3.1MB
Sample260901-171fvafa65
SHA256 d027d344c18af50a18e5e8d2538f4136f92eadf170a1df044d02b7d15859c394
MD5 047601579dafadef8f1ec061ba2b3293
SHA1 51b37e4edb606afc0c2046d4fa27ffc3014ebf79
SHA512 285b3ca9e2d149b2e921fcccd83dd562689b296f7b1dc6edbc91a556f9396829a29e3828b906f23724a391882b6c5b017c2e2f70fb627575772971568718d98e
SSDEEP 49152:tAna/MloRuTxHorZ984+oEqEJ+RuDdh4AUIYkJSmsoFjT2piPqfVkX:MtZCDhuALQJS5QgFfVkX
TLSH
T1C4E58C56E3B800E8DAB6D138C9564607E7F2B81413629BCF07B54BAA1F237E51E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-01_047601579dafadef8f1ec061ba2b3293_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-09-01_047601579dafadef8f1ec061ba2b3293_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 3.1MB

2026-09-01_047601579dafadef8f1ec061ba2b3293_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH f204b78458c18e0010f552ccac589260
SHA256 d027d344c18af50a18e5e8d2538f4136f92eadf170a1df044d02b7d15859c394
MD5 047601579dafadef8f1ec061ba2b3293
SHA1 51b37e4edb606afc0c2046d4fa27ffc3014ebf79
SHA512 285b3ca9e2d149b2e921fcccd83dd562689b296f7b1dc6edbc91a556f9396829a29e3828b906f23724a391882b6c5b017c2e2f70fb627575772971568718d98e
SSDEEP 49152:tAna/MloRuTxHorZ984+oEqEJ+RuDdh4AUIYkJSmsoFjT2piPqfVkX:MtZCDhuALQJS5QgFfVkX
TLSH
T1C4E58C56E3B800E8DAB6D138C9564607E7F2B81413629BCF07B54BAA1F237E51E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1825332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Landun\workspace\CommonComponent\ACE-Service\1.compile_source\output\x64\ACE_pub\ACE-Service64.pdb

shlwapi

SHGetValueA PathRemoveFileSpecW UrlEscapeA PathRemoveFileSpecA PathRemoveBackslashA PathIsRootA PathFileExistsA PathFindFileNameW

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW

ws2_32

WSACloseEvent WSACreateEvent sendto recvfrom htons WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAIoctl htonl __WSAFDIsSet select gethostname socket setsockopt listen closesocket bind accept WSASetLastError send recv freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup ntohs getsockopt getsockname ioctlsocket getpeername connect

wldap32

ord60 ord50 ord41 ord217 ord26 ord27 ord32 ord33 ord35 ord79 ord143 ord211 ord22 ord30 ord200 ord301 ord46

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertCloseStore

netapi32

Netbios

dbghelp

ImageDirectoryEntryToData

pdh

PdhCloseQuery PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryW PdhAddCounterW

kernel32

ResumeThread SwitchToThread GetCurrentProcess OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle LocalFree GetTickCount GetModuleFileNameW InitializeCriticalSectionEx OpenEventW MultiByteToWideChar DecodePointer DeleteCriticalSection GetModuleHandleW ReadFile CreateFileW GetFileAttributesW DeleteFileW GetProcAddress WideCharToMultiByte UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile HeapSize HeapReAlloc HeapAlloc GetProcessHeap SetNamedPipeHandleState WriteFile CreateNamedPipeW WaitForSingleObject CreateEventW SetEvent SetCurrentDirectoryW ConnectNamedPipe FlushFileBuffers EnterCriticalSection LeaveCriticalSection DuplicateHandle CreateProcessW VirtualFree VirtualAlloc GetModuleHandleA LoadLibraryExA FindResourceA LockResource LoadResource FreeLibrary lstrcmpiW CreateMutexW ReleaseMutex GetSystemDirectoryW SetFileAttributesW ExpandEnvironmentStringsA CompareFileTime FindClose FindFirstFileA FindNextFileA CreateEventA GetCurrentProcessId CreateThread GlobalMemoryStatusEx GetSystemInfo HeapFree CreateFileA DeleteFileA GetCurrentThreadId CreateDirectoryA GetFileAttributesA GetSystemDirectoryA LoadLibraryA SetUnhandledExceptionFilter AddVectoredExceptionHandler ReadProcessMemory SetEndOfFile SetFilePointerEx VirtualQuery IsBadReadPtr Module32FirstW OutputDebugStringA RtlCaptureContext GetCurrentThread VirtualProtect ResetEvent UnhandledExceptionFilter VerSetConditionMask OpenMutexW MapViewOfFileEx VerifyVersionInfoW GetTickCount64 SetLastError GetFileType GetStdHandle InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateFiber DeleteFiber SwitchToFiber GetSystemTimeAsFileTime QueryPerformanceCounter ConvertThreadToFiber ConvertFiberToThread GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA CreateMutexA QueryPerformanceFrequency FormatMessageW MoveFileExA GetEnvironmentVariableA WaitForMultipleObjects PeekNamedPipe RtlUnwind SuspendThread GetThreadContext SetThreadContext FlushInstructionCache LoadLibraryExW LCMapStringEx EncodePointer WakeConditionVariable TryAcquireSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx GetStringTypeW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess RtlVirtualUnwind RtlLookupFunctionEntry GetCPInfo OutputDebugStringW RaiseException RtlUnwindEx RtlPcToFileHeader ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileAttributesExW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess SetConsoleCtrlHandler GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetStdHandle GetCurrentDirectoryW GetFullPathNameW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetModuleFileNameA SleepEx SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

GetMonitorInfoA SendMessageTimeoutA IsWindowVisible GetUserObjectInformationW MessageBoxA EnumWindows GetWindowThreadProcessId EnumDisplayDevicesA EnumDisplaySettingsA GetDesktopWindow GetProcessWindowStation MonitorFromWindow GetWindow

shell32

SHGetFolderPathA SHGetSpecialFolderPathA

advapi32

CryptAcquireContextA CryptGenRandom ReportEventA RegisterEventSourceA DeregisterEventSource SetNamedSecurityInfoA GetNamedSecurityInfoA SetEntriesInAclA RegQueryValueExA RegOpenKeyExA RegGetValueA RegCreateKeyExA RegSetValueExA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyExW RegDeleteValueW CryptGetHashParam RegQueryValueExW CryptReleaseContext CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W DeleteService ControlService OpenProcessToken StartServiceW ChangeServiceConfigW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

788KB

Virtual Size

787KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tvm0

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-01_047601579dafadef8f1ec061ba2b3293_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

shlwapi

version

ws2_32

wldap32

crypt32

netapi32

dbghelp

pdh

kernel32

user32

shell32

advapi32

generic