2026-09-10_84ef0854592b517b3ecdb48405bf62d2_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

General

Target
2026-09-10_84ef0854592b517b3ecdb48405bf62d2_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
Size 5.2MB
Sample260910-rrysmsvdkc
SHA256 eda772a5fcb067fe6a2cc87d9486cb36f009e897bf0fe6c2834b585a39d61734
MD5 84ef0854592b517b3ecdb48405bf62d2
SHA1 64b88b8ae528308049f3bc0331e0b14385d6d492
SHA512 66df2e2aa4e77d639825ae5d443939edac0625fafdda79897516185bfe3e122dad7c37c55aa0273db91e0743c8741ad7a94b4e11a3a68300821eec915faf788d
SSDEEP 98304:v+pxbcBXUYMff0GNaVnLWkXjY1bblYjEuOm:vAbcOYMf9NyPXjYR+YuO
TLSH
T1F346AE1667E801E8D1B7D13CC9568623E3F2BC5517709BCB06A0A67A0F63BE16E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_84ef0854592b517b3ecdb48405bf62d2_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-09-10_84ef0854592b517b3ecdb48405bf62d2_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 5.2MB

2026-09-10_84ef0854592b517b3ecdb48405bf62d2_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH f7b32b543a9e8826b88155bfc7e9bd45
SHA256 eda772a5fcb067fe6a2cc87d9486cb36f009e897bf0fe6c2834b585a39d61734
MD5 84ef0854592b517b3ecdb48405bf62d2
SHA1 64b88b8ae528308049f3bc0331e0b14385d6d492
SHA512 66df2e2aa4e77d639825ae5d443939edac0625fafdda79897516185bfe3e122dad7c37c55aa0273db91e0743c8741ad7a94b4e11a3a68300821eec915faf788d
SSDEEP 98304:v+pxbcBXUYMff0GNaVnLWkXjY1bblYjEuOm:vAbcOYMf9NyPXjYR+YuO
TLSH
T1F346AE1667E801E8D1B7D13CC9568623E3F2BC5517709BCB06A0A67A0F63BE16E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

3038104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\pub_1h8po\rc_con_WAI_kso_v1\Build\Release_x64\WPSOffice\wtoolex\updateself_i18n.pdb

kernel32

VerSetConditionMask CloseHandle GetLastError SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetCurrentProcess GetCurrentThread GetSystemDirectoryW FreeLibrary GetProcAddress LoadLibraryW LocalFree VerifyVersionInfoW GetDateFormatW GetTimeFormatW GetEnvironmentVariableW SetEnvironmentVariableW GetFileAttributesW OpenProcess GlobalMemoryStatusEx GetNativeSystemInfo GetModuleFileNameW GetPrivateProfileIntW GetPrivateProfileStringW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID GetUserDefaultLCID ExpandEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx ReadFile Sleep GetModuleHandleW MoveFileExW GlobalFree WriteFile WaitNamedPipeW GetOverlappedResult CancelIo WaitForSingleObject GetLongPathNameW GetCurrentProcessId TerminateProcess GetExitCodeProcess ProcessIdToSessionId GetVersionExW FindResourceExW LoadResource LockResource SizeofResource FindResourceW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocalTime SetFilePointer SetEvent ResetEvent CreateEventW CreateThread GetExitCodeThread ResumeThread GetTickCount MoveFileW WritePrivateProfileStringW GetFileSize RtlCaptureContext SetUnhandledExceptionFilter GetCurrentThreadId GetProcessId SetFileAttributesW GetPrivateProfileSectionW GetCommandLineW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetFileAttributesExW OutputDebugStringW ReleaseMutex CreateMutexW lstrlenA GetDriveTypeW DeviceIoControl lstrlenW GetUserDefaultUILanguage WTSGetActiveConsoleSessionId CreateProcessW CreateFileA GetStartupInfoW GetSystemTime LoadLibraryExW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency LoadLibraryA SleepEx QueryPerformanceCounter GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime GetSystemTimeAsFileTime GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects FormatMessageW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW RtlVirtualUnwind SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime FreeEnvironmentStringsW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW InitOnceBeginInitialize InitOnceComplete FormatMessageA FindFirstFileExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EncodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo IsDebuggerPresent WaitForSingleObjectEx RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx VirtualAlloc SetConsoleCtrlHandler SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread ExitProcess WriteConsoleW GetConsoleCP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW RtlUnwind

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

976KB

Virtual Size

975KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

254KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_84ef0854592b517b3ecdb48405bf62d2_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

kernel32

generic