2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar
Size 8.9MB
Sample260930-ct2vravwby
SHA256 36a6dfd355b7c3c1119ea2c44d22dec86aee3178b35d80e86dfd07c8261c73ce
MD5 42db9825d91c7b87f94234b87f4a5ba5
SHA1 c96d447bab4cd3c27aae9b1eec45776a5bc551ea
SHA512 abf931eb411560ef75ee63a04a2c0702bd87ae9fad35c1303a24ec5d804ba1bbd93d12b3e6ba0c17ae4fd477719cc1c00aebd73a8f2e5ab37a24a159fa5830f1
SSDEEP 98304:qOjygqTeYtrA2CQ+J1bMfwKNNUtiOWh5eI54rItr8ihz5tiw1j2+OFae348KYpf0:bxVX1bMf4ir/eI5PDBtHOQe3LIOYQp
TLSH
T1DD969E07F29580EDC09EC2B8C70AE637E632B8894634B69F27945F126F76B905F1E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar

File Explorer

2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar

.exe 8.9MB

2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar

IMPHASH 2b245cba86ad829d35e01939ca6fa326
SHA256 36a6dfd355b7c3c1119ea2c44d22dec86aee3178b35d80e86dfd07c8261c73ce
MD5 42db9825d91c7b87f94234b87f4a5ba5
SHA1 c96d447bab4cd3c27aae9b1eec45776a5bc551ea
SHA512 abf931eb411560ef75ee63a04a2c0702bd87ae9fad35c1303a24ec5d804ba1bbd93d12b3e6ba0c17ae4fd477719cc1c00aebd73a8f2e5ab37a24a159fa5830f1
SSDEEP 98304:qOjygqTeYtrA2CQ+J1bMfwKNNUtiOWh5eI54rItr8ihz5tiw1j2+OFae348KYpf0:bxVX1bMf4ir/eI5PDBtHOQe3LIOYQp
TLSH
T1DD969E07F29580EDC09EC2B8C70AE637E632B8894634B69F27945F126F76B905F1E714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5636940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/home/build/sublime_text/build/gn/lto_win_x64/sublime_text.pdb

user32

AdjustWindowRectEx AllowSetForegroundWindow AppendMenuW BeginDeferWindowPos BeginPaint CheckMenuItem ClientToScreen CloseClipboard CopyRect CreateCaret CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DeferWindowPos DestroyCaret DestroyMenu DestroyWindow DispatchMessageW EmptyClipboard EnableMenuItem EnableWindow EndDeferWindowPos EndPaint EnumClipboardFormats EnumDisplayMonitors FillRect GetActiveWindow GetCapture GetCaretBlinkTime GetClassInfoExW GetClientRect GetClipboardData GetClipboardFormatNameW GetCursorPos GetDC GetDCEx GetDoubleClickTime GetFocus GetIconInfo GetKeyState GetMenu GetMenuItemCount GetMenuItemID GetMessageTime GetMonitorInfoW GetParent GetSubMenu GetSysColor GetSystemMenu GetSystemMetrics GetUpdateRgn GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect HideCaret InsertMenuW InvalidateRect IsIconic IsWindowVisible KillTimer LoadCursorW MessageBoxW ModifyMenuW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW PtInRect RegisterClassExW RegisterClipboardFormatA RegisterClipboardFormatW ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageW SetCapture SetCaretPos SetClipboardData SetCursor SetFocus SetForegroundWindow SetMenu SetMenuDefaultItem SetMenuInfo SetMenuItemInfoW SetScrollInfo SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TrackPopupMenuEx TranslateMessage UpdateLayeredWindow wsprintfA wsprintfW

wininet

HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetOpenW InternetReadFile

ole32

CoCreateInstance CoInitialize CoLockObjectExternal CoTaskMemFree CoUninitialize DoDragDrop OleInitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop

ntdll

NtQueryDirectoryFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

kernel32

AcquireSRWLockExclusive CancelIo CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateNamedPipeA CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersion GetVersionExW GetVolumeInformationByHandleW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenEventW OpenFileMappingW OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadDirectoryChangesW ReadFile ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SleepEx SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeA WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

comdlg32

ChooseFontW CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgn CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesExW GetCurrentObject GetDIBits GetDeviceCaps GetObjectW GetRegionData GetStockObject GetTextExtentPointW GetTextMetricsW Rectangle SelectClipRgn SelectObject SetBkMode SetDCBrushColor SetDCPenColor SetPixelFormat SetTextColor TextOutW

comctl32

ord345

shell32

CommandLineToArgvW DragAcceptFiles DragQueryFileW ExtractIconExW ord190 ord155 SHAddToRecentDocs SHBrowseForFolderW SHCreateItemFromParsingName ord74 SHFileOperationW SHGetFolderPathW SHGetPathFromIDListW SHOpenFolderAndSelectItems ShellExecuteW

imm32

ImmGetCompositionStringW ImmGetContext ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow

opengl32

glBindTexture glBlendFunc glClear glClearColor glDeleteTextures glDisable glDrawArrays glDrawElements glEnable glFlush glGenTextures glGetError glGetString glPixelStorei glScissor glTexImage2D glTexParameteri glTexSubImage2D glViewport wglCreateContext wglDeleteContext wglMakeCurrent wglShareLists

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmFlush DwmGetColorizationColor DwmGetCompositionTimingInfo DwmIsCompositionEnabled DwmSetWindowAttribute

uxtheme

DrawThemeTextEx GetThemeSysFont OpenThemeData

Name

.text

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

256KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

203KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

48B

Characteristics

Name

.tls

Size

512B

Virtual Size

65B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar

user32

wininet

ole32

ntdll

kernel32

advapi32

comdlg32

gdi32

comctl32

shell32

imm32

opengl32

dwmapi

uxtheme

generic