2026-10-08_4bd7ed329639562cf638c54beb0f1734_cobalt-strike_coinminer_glassworm_remcos_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_4bd7ed329639562cf638c54beb0f1734_cobalt-strike_coinminer_glassworm_remcos_satacom
Size 1.4MB
Sample261009-sty2vsav4z
SHA256 134de9a70ede7a95b22766439df2a505d075e748a6378b72399f8de97d207b22
MD5 4bd7ed329639562cf638c54beb0f1734
SHA1 cd4b10a57d392547dad9aa130365b76bf365c741
SHA512 e430bbc655f7c463c24c8d56583d1d845f730d1565cdec53cd294321628632b43cd518a29da8bd8ff543204272f2338ce692f1f90735904d7985b42c4afc0c18
SSDEEP 24576:xj5nBv4TKDD6hF+AeoU997vX7uKbssmSSgYuhGvrB0i0MxT26TzxEi9KI9cCjOyE:xjnvVDD6hcAAbmSS190i0MR26TzxEi93
TLSH
T124656C47A3B841E8D563C278C6025617EBB2B41833349BEF57908AA67F53BE2173E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_4bd7ed329639562cf638c54beb0f1734_cobalt-strike_coinminer_glassworm_remcos_satacom

File Explorer

2026-10-08_4bd7ed329639562cf638c54beb0f1734_cobalt-strike_coinminer_glassworm_remcos_satacom

.exe 1.4MB

2026-10-08_4bd7ed329639562cf638c54beb0f1734_cobalt-strike_coinminer_glassworm_remcos_satacom

IMPHASH 18bd8518d42665355f6ea1a03ec6c43d
SHA256 134de9a70ede7a95b22766439df2a505d075e748a6378b72399f8de97d207b22
MD5 4bd7ed329639562cf638c54beb0f1734
SHA1 cd4b10a57d392547dad9aa130365b76bf365c741
SHA512 e430bbc655f7c463c24c8d56583d1d845f730d1565cdec53cd294321628632b43cd518a29da8bd8ff543204272f2338ce692f1f90735904d7985b42c4afc0c18
SSDEEP 24576:xj5nBv4TKDD6hF+AeoU997vX7uKbssmSSgYuhGvrB0i0MxT26TzxEi9KI9cCjOyE:xjnvVDD6hcAAbmSS190i0MR26TzxEi93
TLSH
T124656C47A3B841E8D563C278C6025617EBB2B41833349BEF57908AA67F53BE2173E351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1116112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptGenRandom CryptAcquireContextA CryptReleaseContext

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreA

ws2_32

gethostname ioctlsocket sendto recvfrom listen htonl freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl WSASetLastError socket setsockopt recv ntohs getsockname getpeername connect closesocket bind accept WSACleanup WSAStartup WSAWaitForMultipleEvents WSAGetLastError WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt htons

iphlpapi

if_nametoindex

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z

kernel32

VerifyVersionInfoW GetProcAddress GetModuleHandleW VerSetConditionMask InitializeConditionVariable QueryPerformanceFrequency QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepEx MultiByteToWideChar GetStdHandle SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId InitializeCriticalSection FindNextFileA FindFirstFileA FindClose CreateThread WaitForSingleObjectEx SleepConditionVariableCS WakeConditionVariable CloseHandle FormatMessageA SetLastError GetLastError WaitForMultipleObjects PeekNamedPipe ReadFile GetEnvironmentVariableA MoveFileExW Sleep GetFullPathNameW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetFileType

vcruntime140

__std_exception_destroy _CxxThrowException memcpy memchr memcmp __std_exception_copy memset strchr strrchr strstr __C_specific_handler __current_exception __current_exception_context memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

_write _lseeki64 ferror _read fwrite setvbuf _set_fmode fputc _close __stdio_common_vsprintf fopen fflush __stdio_common_vfprintf __acrt_iob_func __p__commode fputs fread _fileno ftell _fseeki64 feof fclose fseek _wfsopen _wsopen_s fgets

api-ms-win-crt-string-l1-1-0

_strdup strcpy_s strtok_s strncpy strpbrk strlen strcmp strspn tolower strncmp strcspn wcsncmp wcsncpy_s wcscpy_s _stricmp

api-ms-win-crt-math-l1-1-0

_fdopen ceilf __setusermatherr pow log

api-ms-win-crt-heap-l1-1-0

free _callnewh realloc calloc _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _get_initial_narrow_environment _initialize_onexit_table _configure_narrow_argv _errno _register_onexit_function _initterm terminate _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _crt_atexit strerror_s _cexit _c_exit _initialize_narrow_environment

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _wstat64 _fullpath _unlink

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64 _gmtime64_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_4bd7ed329639562cf638c54beb0f1734_cobalt-strike_coinminer_glassworm_remcos_satacom

advapi32

crypt32

ws2_32

iphlpapi

msvcp140

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic