2026-09-24_537c65b0794123a60bc3ae49e0625301_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_537c65b0794123a60bc3ae49e0625301_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 43.4MB
Sample260925-lsfessvt8n
SHA256 912267f3735d78908f5b76ddfdc4f845c151a696210c8348cb960de1467a72e4
MD5 537c65b0794123a60bc3ae49e0625301
SHA1 10269a174a056856df6a2744f945c4bb5d8bcfdf
SHA512 26b2fd76252a03ce247e2bddd6eab270c782f8619226edfcdad53fea9bef5891bc91eb91d56ffb09e9f531aeafdc146cbac9c4edd26d0eda2ce89a35fae265fd
SSDEEP 393216:bW3biLa3L9NJ7W51AmOW1ZEk3Jp5LavN/wmYCYC9QBo1m7iuZRJqjW41DKGGg32/:S3biGRN1+qbwewbkvNfazvqDKdl
TLSH
T1A8A75A4296D87DD1C032A230E7BB8FF1C669AC555628828F11C1FE473D3A693792B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

agilenet

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Detects executables packed with Agile.NET / CliSecure 1 IoCs

resource	yara_rule
static1/unpack001/bunifu.ui.winforms.1.5.3.dll	INDICATOR_EXE_Packed_AgileDotNet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
static1/unpack001/bunifu.ui.winforms.1.5.3.dll	agile_net

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
unpack001/bunifu.ui.winforms.1.5.3.dll

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_537c65b0794123a60bc3ae49e0625301_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
unpack001/costura.dll
unpack001/naudio.asio.dll
unpack001/naudio.core.dll
unpack001/naudio.midi.dll
unpack001/naudio.wasapi.dll
unpack001/naudio.winforms.dll
unpack001/naudio.winmm.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/guna.ui2.dll

File Explorer

2026-09-24_537c65b0794123a60bc3ae49e0625301_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 43.4MB
bunifu.ui.winforms.1.5.3.dll

.dll 344KB
costura.dll

.dll 5KB
costura.pdb

7KB
guna.ui2.dll

.dll 2.1MB
microsoft.win32.registry.dll

.dll 22KB
naudio.asio.dll

.dll 33KB
naudio.core.dll

.dll 183KB
naudio.midi.dll

.dll 45KB
naudio.wasapi.dll

.dll 175KB
naudio.winforms.dll

.dll 40KB
naudio.winmm.dll

.dll 56KB
system.security.accesscontrol.dll

.dll 30KB
system.security.principal.windows.dll

.dll 14KB

2026-09-24_537c65b0794123a60bc3ae49e0625301_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

SHA256 912267f3735d78908f5b76ddfdc4f845c151a696210c8348cb960de1467a72e4
MD5 537c65b0794123a60bc3ae49e0625301
SHA1 10269a174a056856df6a2744f945c4bb5d8bcfdf
SHA512 26b2fd76252a03ce247e2bddd6eab270c782f8619226edfcdad53fea9bef5891bc91eb91d56ffb09e9f531aeafdc146cbac9c4edd26d0eda2ce89a35fae265fd
SSDEEP 393216:bW3biLa3L9NJ7W51AmOW1ZEk3Jp5LavN/wmYCYC9QBo1m7iuZRJqjW41DKGGg32/:S3biGRN1+qbwewbkvNfazvqDKdl
TLSH
T1A8A75A4296D87DD1C032A230E7BB8FF1C669AC555628828F11C1FE473D3A693792B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bunifu.ui.winforms.1.5.3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e2248459dcc95183d0f0c5f3abd3b0a2b93cd26cf8e130a1f43c8b32c58f4c8f
MD5 b4280d2898d92ab5c3911f0305d7672f
SHA1 0ef4d6fa24811cea3cb36fccbc45d71e1effb17d
SHA512 2c719c32144ce2968123dc8e3a6f61f70460e463ba9b3681dc86e124af1343d08e574f7313339ecef4b88f95d2fd9ad56462f0f9e5f9f51ba5de6ba19559af2e
SSDEEP 6144:m6BxSPUIfFVoPH+GBhvPb8g2iYcHIc7RPqEev3djE5ydvmW:vxSsIfFieGjb8ncHFqEevNjE5ydvN
TLSH
T18F741AC15995ACE2C3D74B7AE7113143D73898A07ADAE70BD68411EC1AE2FEBC84D187
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Detects executables packed with Agile.NET / CliSecure
Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

f6:c0:05:67:21:bf:57:7b:47:65:79:ba:d6:14:08:38:c2:50:f8:8a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,POSTALCODE=00100,STREET=H No 3\, Past the Bridge\, Zambia Road\, Ngong,L=Ngong Town,ST=Nairobi,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Nov 24, 2020

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 19, 2010 - Jan 18, 2038

Subject

Serial Number

02:e2:91:16:68:ef:42:32:1b:05:ea:84:d6:01:f4:0e

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 20, 2020 - Mar 20, 2021

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

348050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Willy\source\repos\bunifu\bunifu_framework\willy_kimura\__build__\__secured__\Bunifu UI WinForms\Bunifu.UI.WinForms.1.5.3.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
MD5 b464fc896b14bfa34f608da53856e999
SHA1 55568eecc97895cad49a42bffe757e3588c5313c
SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
TLSH
T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:ea:da:1b:68:34:55:c7:9d:54:32:02:aa:3a:3b:97:1e:fa:ea:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Feb 18, 2025

CN=Sobatdata Software

Minor OS version

Major OS version

Entry point

2188926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

microsoft.win32.registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody

Digest

5e:d3:f9:23:6b:09:bd:27:29:6e:be:e0:b7:d2:f4:95:7f:a3:7e:ad:a3:49:ee:89:bf:31:0e:bd:89:19:30:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

19162

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb

naudio.asio.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
MD5 eb254b04d63a9f03b77563243805f68f
SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
TLSH
T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb

naudio.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
MD5 48867f392b8e77dc06c062638c6fbd36
SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
TLSH
T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

190890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb

naudio.midi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
MD5 3f5c79100f4f7902114c3fcba275c606
SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
TLSH
T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb

naudio.wasapi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
TLSH
T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

185178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb

naudio.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
MD5 be8205f435b2afbfd178960c46310c17
SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
TLSH
T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb

naudio.winmm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
MD5 faf1ba532964984a34d60674fbc7a5a7
SHA1 0999178949de510a47d87de3b8a117a003c572ee
SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
TLSH
T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

63254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb

system.security.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody

Digest

4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

26694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb

system.security.principal.windows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables Discord URL observed in first stage droppers
Detects executables manipulated with Fody

Digest

66:14:6a:1c:ea:9c:3d:ac:d8:5a:fb:65:4e:52:79:df:9d:05:29:ea:6b:fd:f3:7b:a3:29:c0:13:11:0a:76:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

11394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb

2026-09-24_537c65b0794123a60bc3ae49e0625301_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

generic

bunifu.ui.winforms.1.5.3.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

guna.ui2.dll

PE Signature issue

mscoree

dotnet

microsoft.win32.registry.dll

mscoree

dotnet

naudio.asio.dll

mscoree

dotnet

naudio.core.dll

mscoree

dotnet

naudio.midi.dll

mscoree

dotnet

naudio.wasapi.dll

mscoree

dotnet

naudio.winforms.dll

mscoree

dotnet

naudio.winmm.dll

mscoree

dotnet

system.security.accesscontrol.dll

mscoree

dotnet

system.security.principal.windows.dll

mscoree

dotnet