2026-09-27_57e7ebaad071c27d729a5134e139b5ba_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_57e7ebaad071c27d729a5134e139b5ba_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
Size 5.3MB
Sample260928-ymd11attex
SHA256 9dab323bac1e05275d4ff56a6155c0f0462370631827a30fe76fac6758dc602f
MD5 57e7ebaad071c27d729a5134e139b5ba
SHA1 9304f84f1ec17bfc01bcd1e39d6acb413ae4f3fc
SHA512 01a1d8ecebc06e64eca0c77dcad36f0b31414345be7dbd763b3d00d72f803a55c5d59e1feb4dab786f8c303507220b0798591063ad48c1639aaf71239d1cf363
SSDEEP 49152:nOjPWCYlcqtdNuNoY1UOPGFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamL+:FdqUfYaQzVpEBTQtB71TmSvc2k
TLSH
T13A469D56A3A500FCD1B6C178CE964527E7B2BC061371DBDF02A0666A1F37AE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_57e7ebaad071c27d729a5134e139b5ba_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-09-27_57e7ebaad071c27d729a5134e139b5ba_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 5.3MB

2026-09-27_57e7ebaad071c27d729a5134e139b5ba_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH b413a21deafbf683d85bbfbcea09a6d5
SHA256 9dab323bac1e05275d4ff56a6155c0f0462370631827a30fe76fac6758dc602f
MD5 57e7ebaad071c27d729a5134e139b5ba
SHA1 9304f84f1ec17bfc01bcd1e39d6acb413ae4f3fc
SHA512 01a1d8ecebc06e64eca0c77dcad36f0b31414345be7dbd763b3d00d72f803a55c5d59e1feb4dab786f8c303507220b0798591063ad48c1639aaf71239d1cf363
SSDEEP 49152:nOjPWCYlcqtdNuNoY1UOPGFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamL+:FdqUfYaQzVpEBTQtB71TmSvc2k
TLSH
T13A469D56A3A500FCD1B6C178CE964527E7B2BC061371DBDF02A0666A1F37AE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5423104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord344 InitCommonControlsEx ord345

kernel32

WakeAllConditionVariable SleepConditionVariableSRW CreateMutexW OpenMutexW CreateThread GetCurrentThread GetCurrentThreadId GetSystemTime GetTickCount64 SystemTimeToFileTime GetPrivateProfileIntW VirtualQuery OpenFileMappingW WriteFile FormatMessageW VerSetConditionMask OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext VerifyVersionInfoW LoadLibraryA FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetPrivateProfileStringW WritePrivateProfileStringW GetFullPathNameW SetFileTime GetSystemTimeAsFileTime GetEnvironmentVariableW SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW SetEvent WaitForSingleObject CreateEventW GetExitCodeProcess OpenProcess GetSystemDirectoryW IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject SetDllDirectoryW AcquireSRWLockExclusive GetCurrentProcessId WaitForMultipleObjects CreateRemoteThread GetExitCodeThread GetProcessId VirtualAllocEx ReadProcessMemory WriteProcessMemory QueryFullProcessImageNameW K32EnumProcessModules K32GetModuleFileNameExW K32GetModuleInformation K32GetProcessImageFileNameW ReadFile GetOverlappedResult FreeLibrary MulDiv RtlUnwind MultiByteToWideChar MoveFileW CopyFileW LocalFree GetModuleFileNameW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP SetEndOfFile GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW GetConsoleOutputCP SetFilePointerEx SetConsoleCtrlHandler SetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW ReleaseSRWLockExclusive CreateDirectoryW VirtualProtect GetStartupInfoW GetFileAttributesExW ExitProcess UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateProcessW Sleep GetLastError CloseHandle GetFileAttributesW DeleteFileW CreateFileW FreeLibraryAndExitThread ExitThread LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader LoadLibraryExA RaiseException IsProcessorFeaturePresent GetCommandLineW LoadLibraryW GetProcAddress GetModuleHandleW TerminateProcess GetCurrentProcess IsDebuggerPresent CompareFileTime UnhandledExceptionFilter InitializeSListHead HeapCreate HeapAlloc HeapReAlloc HeapFree FlushInstructionCache CreateToolhelp32Snapshot Thread32First Thread32Next GetSystemInfo VirtualAlloc VirtualFree WriteConsoleW OutputDebugStringA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS GetTickCount GetVersion GlobalMemoryStatus QueryPerformanceCounter WideCharToMultiByte SetFilePointer FormatMessageA CreateEventA WaitForSingleObjectEx GetLocaleInfoA FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW EnumSystemLocalesA IsValidCodePage IsDBCSLeadByteEx DuplicateHandle SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW ResetEvent SetUnhandledExceptionFilter ReleaseSemaphore CreateSemaphoreW VirtualQueryEx GetProcessTimes UnregisterWaitEx UnregisterWait ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW ReleaseMutex RegisterWaitForSingleObject GetStdHandle GetFileType SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionEx SleepEx QueryPerformanceFrequency GetEnvironmentVariableA MoveFileExW GetModuleHandleA GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx TryAcquireSRWLockExclusive EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

user32

LoadIconW LoadCursorW FindWindowExW GetDesktopWindow SetWindowLongW GetWindowLongW GetSysColorBrush GetSysColor MonitorFromPoint SetWindowRgn EndPaint BeginPaint ReleaseDC GetDC AllowSetForegroundWindow SetTimer SetWindowPos MoveWindow ShowWindow CreateWindowExW RegisterClassExW DefWindowProcW RegisterWindowMessageW SendMessageW GetProcessWindowStation GetUserObjectInformationW DestroyWindow MsgWaitForMultipleObjects PeekMessageW DispatchMessageW TranslateMessage MessageBoxW SetWindowTextW

gdi32

SetBkMode GetDeviceCaps CreateRoundRectRgn CreateFontIndirectW SetTextColor

advapi32

RegEnumValueW RegisterEventSourceW DeregisterEventSource RegSetKeyValueW RegGetValueW RegDeleteKeyW OpenProcessToken GetTokenInformation RegCloseKey RegOpenKeyW ReportEventW RegDeleteValueW

shell32

SHBindToParent SetCurrentProcessExplicitAppUserModelID SHSetLocalizedName ord709 SHGetKnownFolderPath SHCreateItemFromParsingName ShellExecuteW CommandLineToArgvW SHParseDisplayName

crypt32

CertFreeCertificateContext CertOpenSystemStoreW CertGetIntendedKeyUsage CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreA CertGetEnhancedKeyUsage

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry NtQueryInformationProcess

oleaut32

SysFreeString SysAllocString GetErrorInfo SetErrorInfo SysStringLen

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

134KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

310KB

Virtual Size

309KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

79KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdf17

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_57e7ebaad071c27d729a5134e139b5ba_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar

comctl32

kernel32

user32

gdi32

advapi32

shell32

crypt32

ntdll

oleaut32

generic