2026-09-23_88dc92f6a971e729fb6e5831ffad806f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

General

Target
2026-09-23_88dc92f6a971e729fb6e5831ffad806f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 35.4MB
Sample260923-1xefmaec94
SHA256 ebedf9d42fed3c0e7fb2dc08c8b648975a52bbb10459a1fd5bb6a4b9a7fffe54
MD5 88dc92f6a971e729fb6e5831ffad806f
SHA1 624e354fab4e492cec7eaefff4b74cb204849ea6
SHA512 7a3f122e555f086778b17c6cd5d74ccaa197ebc137c99662e66c6111708e52b7de1e23ff8f198791a48b85c7dd8724981d7de4f3421bc8728bdb06196ccd5bf1
SSDEEP 24576:J7ElgpQqjymzQ2zREmn41ywtdrvTfN3fKlZ:J7E2Q8zxaNrDN3fKlZ
TLSH
T159876B7F8FAD9DCF6800644D0DA5FC988B8F297C0D99CB01DF62318159F1EA51EE129A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-23_88dc92f6a971e729fb6e5831ffad806f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-09-23_88dc92f6a971e729fb6e5831ffad806f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 35.4MB

2026-09-23_88dc92f6a971e729fb6e5831ffad806f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH 9845fc77376441fad9721e037533c0ac
SHA256 ebedf9d42fed3c0e7fb2dc08c8b648975a52bbb10459a1fd5bb6a4b9a7fffe54
MD5 88dc92f6a971e729fb6e5831ffad806f
SHA1 624e354fab4e492cec7eaefff4b74cb204849ea6
SHA512 7a3f122e555f086778b17c6cd5d74ccaa197ebc137c99662e66c6111708e52b7de1e23ff8f198791a48b85c7dd8724981d7de4f3421bc8728bdb06196ccd5bf1
SSDEEP 24576:J7ElgpQqjymzQ2zREmn41ywtdrvTfN3fKlZ:J7E2Q8zxaNrDN3fKlZ
TLSH
T159876B7F8FAD9DCF6800644D0DA5FC988B8F297C0D99CB01DF62318159F1EA51EE129A
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9d:98:21:ef:84:2f:27:b5:c7:19:8d:8c:10:7c:2c:ea:94:b8:ba:07:f5:c0:c9:4d:29:64:c9:4b:14:50:fd:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Sep 23, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

PE Signature issue

Digest

9b:8a:87:14:24:e5:d9:fd:49:41:5c:f1:33:8a:b3:9f:49:1a:c3:10

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Sep 23, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Minor OS version

0

Major OS version

6

Entry point

29388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

IsProcessorFeaturePresent WriteConsoleW HeapSize DeleteFileW GetProcAddress GetModuleHandleA CreateEventW LoadLibraryA FreeLibrary ReadConsoleW RtlCaptureContext GetLastError SizeofResource FindResourceA FormatMessageW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetFullPathNameW WideCharToMultiByte MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetStringTypeW GetCPInfo RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess RtlUnwind CloseHandle InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateFileW GetFileType ExitProcess GetModuleHandleExW ReadFile GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapFree HeapAlloc FlushFileBuffers GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetStdHandle SetEndOfFile GetFileAttributesExW GetCurrentDirectoryW

user32

LoadStringA

Name

.text

Size

776KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

34.5MB

Virtual Size

34.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_88dc92f6a971e729fb6e5831ffad806f_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

PE Signature issue

PE Signature issue

kernel32

user32

generic