2026-10-01_4aaa19655fc09e6184970517543b5f62_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_4aaa19655fc09e6184970517543b5f62_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
Size 20.1MB
Sample261002-spb2jatcja
SHA256 02e2fbcb91ca6a543cd7a09b104d117cfe45aa2cb0606492562bb82fbaaa4be8
MD5 4aaa19655fc09e6184970517543b5f62
SHA1 ab8eb8f76173a923c15015c9d448d86db721178d
SHA512 43d665a4333f656a50c23a5dff505e812b5deee6c16c4b1aab550093b4be306b88af255bede09ac9af4e1582d5486b20907d2a4482c000adacbdb0a381a9f446
SSDEEP 196608:ABL/P0ZMYeFS3BzeCOkvzzg7Oy0P3fEnP:i1YDpNOKzzgSPi
TLSH
T1FC27AE6AA2BC00E8D5BBD17CC6569617E7B1B81503705BDF16A04ABA1F23BE41F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_4aaa19655fc09e6184970517543b5f62_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-10-01_4aaa19655fc09e6184970517543b5f62_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

.exe 20.1MB

2026-10-01_4aaa19655fc09e6184970517543b5f62_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

IMPHASH 5e4b8d94a922cf54b23258e725f8f59f
SHA256 02e2fbcb91ca6a543cd7a09b104d117cfe45aa2cb0606492562bb82fbaaa4be8
MD5 4aaa19655fc09e6184970517543b5f62
SHA1 ab8eb8f76173a923c15015c9d448d86db721178d
SHA512 43d665a4333f656a50c23a5dff505e812b5deee6c16c4b1aab550093b4be306b88af255bede09ac9af4e1582d5486b20907d2a4482c000adacbdb0a381a9f446
SSDEEP 196608:ABL/P0ZMYeFS3BzeCOkvzzg7Oy0P3fEnP:i1YDpNOKzzgSPi
TLSH
T1FC27AE6AA2BC00E8D5BBD17CC6569617E7B1B81503705BDF16A04ABA1F23BE41F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20901888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCloseKey RegOpenKeyExW RegQueryValueExA RegQueryValueExW ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyKey CryptReleaseContext CryptCreateHash CryptHashData CryptDestroyHash CryptAcquireContextW CryptGetHashParam RegOpenKeyExA ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

kernel32

SetEvent CreateEventA GetCurrentThreadId CreateThread WaitForSingleObject LocalFree FormatMessageA GetSystemTimeAsFileTime AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId GetLocalTime FormatMessageW SetLastError CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW LockFileEx SetEndOfFile UnlockFileEx SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler VerSetConditionMask IsWow64Process GetModuleHandleW VerifyVersionInfoW SuspendThread ResumeThread GetProcessId GetThreadContext Wow64GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID FindClose RemoveVectoredExceptionHandler GetFileSizeEx GetFileType ReadFile SetFilePointerEx FindFirstFileExW FindNextFileW GetFileTime RemoveDirectoryW MoveFileExW GetModuleFileNameW DuplicateHandle ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateEventW TerminateProcess OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx VirtualQueryEx ReadProcessMemory LoadLibraryW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion ReleaseSemaphore CreateSemaphoreW RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry UnhandledExceptionFilter CreateSemaphoreA WaitForSingleObjectEx WaitForMultipleObjectsEx GetTickCount GetModuleHandleA GetSystemTime SystemTimeToFileTime FileTimeToSystemTime RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer IsDebuggerPresent FindFirstFileW GetCurrentDirectoryW OutputDebugStringA WakeConditionVariable InitializeConditionVariable SleepConditionVariableSRW GetModuleFileNameA EnterCriticalSection LeaveCriticalSection SleepEx GetFullPathNameW MoveFileExA CreateFileA CompareFileTime GetTickCount64 TryEnterCriticalSection HeapCreate HeapFree GetDiskFreeSpaceW LockFile InitializeCriticalSection SetFilePointer GetTempPathW CreateMutexW UnmapViewOfFile HeapValidate HeapSize GetTempPathA VirtualQuery GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile DeleteFileA HeapReAlloc HeapAlloc HeapCompact HeapDestroy UnlockFile GetFileSize GetProcessHeap CreateFileMappingW MapViewOfFile FlushFileBuffers GetModuleHandleExW DebugBreak GetVersionExA K32GetProcessMemoryInfo GlobalMemoryStatusEx ReleaseMutex OpenSemaphoreW CreateToolhelp32Snapshot Process32First Process32Next K32GetProcessImageFileNameA CreateProcessW CreateMutexExW CreateSemaphoreExW SwitchToThread SleepConditionVariableCS InitializeSListHead GetStartupInfoW GetExitCodeThread GetNativeSystemInfo WakeAllConditionVariable RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockShared AcquireSRWLockShared GetStringTypeW GetLocaleInfoEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetEnvironmentVariableW ExitProcess ExitThread FreeLibraryAndExitThread SetStdHandle GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetCurrentThread IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW QueryPerformanceCounter RtlUnwind FreeLibrary GetProcAddress GetCurrentProcessorNumber GetSystemInfo CloseHandle QueryPerformanceFrequency LoadLibraryA AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFinalPathNameByHandleW GetDiskFreeSpaceExW ConvertThreadToFiberEx ConvertFiberToThread GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW AddVectoredExceptionHandler CopyFileW SetFileTime DeviceIoControl CreateWaitableTimerA GetLogicalProcessorInformation ResetEvent SetWaitableTimer GetLastError Sleep GetEnvironmentVariableA GetFullPathNameA VirtualAlloc WriteFile WriteConsoleA GetStdHandle GetCurrentProcess VirtualFree GetConsoleScreenBufferInfo VirtualProtect GetProcessTimes InitializeSRWLock GetDiskFreeSpaceA

crypt32

CertGetCertificateContextProperty CertOpenSystemStoreW CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore

dbghelp

SymFromAddr

user32

GetWindowLongPtrW SetWindowLongPtrW EnumDisplayDevicesA DestroyWindow GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMessageW TranslateMessage CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW

winmm

timeGetDevCaps timeEndPeriod timeBeginPeriod timeSetEvent timeGetTime

ws2_32

gethostbyaddr getservbyname shutdown inet_ntoa WSACloseEvent WSAResetEvent send WSAWaitForMultipleEvents getsockopt WSAEnumNetworkEvents htonl closesocket socket WSAGetLastError setsockopt freeaddrinfo ntohl getaddrinfo ntohs inet_ntop getservbyport inet_addr gethostbyname WSACreateEvent WSASetEvent sendto getnameinfo gethostname ioctlsocket bind listen accept WSAIoctl getpeername getsockname connect recv recvfrom WSACleanup WSAStartup __WSAFDIsSet select WSASetLastError htons WSAEventSelect WSASocketA

ole32

CoTaskMemFree CoCreateInstance StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx

iphlpapi

GetAdaptersAddresses if_nametoindex

shell32

SHGetFolderPathAndSubDirW

powrprof

CallNtPowerInformation

winhttp

WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryHeaders

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

235KB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

380KB

Virtual Size

380KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdf17

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_4aaa19655fc09e6184970517543b5f62_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

advapi32

api-ms-win-core-synch-l1-2-0

kernel32

crypt32

dbghelp

user32

winmm

ws2_32

ole32

iphlpapi

shell32

powrprof

winhttp

version

generic