2026-10-08_4364d6cbda31597dacc3abb0e20d3965_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_4364d6cbda31597dacc3abb0e20d3965_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
Size 12.4MB
Sample261009-tp8aeabv6s
SHA256 d49f584e7f0c2b5e45652be01b2584f4fa3da2df5edf555e9a5800a9e8c8462f
MD5 4364d6cbda31597dacc3abb0e20d3965
SHA1 470dcf13acf50c583e4a4eea5d40a8b5b8142504
SHA512 f81c435564396d05c27b299a15a427b52146f86e56e271f214303e2c9643ae4f99c7fa52752a59211fbe7111cfb8352cfdcea73f6e8b57ba5728ad72ff5bb014
SSDEEP 98304:e7OyVE0N3qYyYSEArIvhpzzztLkC9RH66f/AUN1vSOw/3/Cuh+gDHW7AzKXy:eiyVE03bztLkkxbf/AG1v5w/3/lTjWxy
TLSH
T138D6AE6AB2BC00E9D4BBD17CC6569617E7B1741503705BDF16A08ABA2F23BE41E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-08_4364d6cbda31597dacc3abb0e20d3965_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-10-08_4364d6cbda31597dacc3abb0e20d3965_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

.exe 12.4MB

2026-10-08_4364d6cbda31597dacc3abb0e20d3965_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

IMPHASH 26fe1deed9fb09ad54de590b02a35770
SHA256 d49f584e7f0c2b5e45652be01b2584f4fa3da2df5edf555e9a5800a9e8c8462f
MD5 4364d6cbda31597dacc3abb0e20d3965
SHA1 470dcf13acf50c583e4a4eea5d40a8b5b8142504
SHA512 f81c435564396d05c27b299a15a427b52146f86e56e271f214303e2c9643ae4f99c7fa52752a59211fbe7111cfb8352cfdcea73f6e8b57ba5728ad72ff5bb014
SSDEEP 98304:e7OyVE0N3qYyYSEArIvhpzzztLkC9RH66f/AUN1vSOw/3/Cuh+gDHW7AzKXy:eiyVE03bztLkkxbf/AG1v5w/3/lTjWxy
TLSH
T138D6AE6AB2BC00E9D4BBD17CC6569617E7B1741503705BDF16A08ABA2F23BE41E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4d:c2:d8:1f:8c:7b:1b:f3:8e:94:e1:01:20:12:07:4f:0a:25:20:17:c8:41:8b:e5:38:55:0f:9e:07:0c:09:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6618956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildAgent\work\gameenginebuck2------43\buck-out\v2\art\root\91276a04239dda55\Client\CrashReport\___loader.exe__\RobloxCrashHandler.pdb

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCloseKey RegOpenKeyExW RegQueryValueExA RegQueryValueExW ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyKey CryptReleaseContext CryptCreateHash CryptHashData CryptDestroyHash CryptAcquireContextW CryptGetHashParam RegOpenKeyExA ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

kernel32

SetEvent GetCurrentThreadId CreateThread WaitForSingleObject LocalFree FormatMessageA AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId GetLocalTime FormatMessageW SetLastError CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW LockFileEx SetEndOfFile UnlockFileEx SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler VerSetConditionMask IsWow64Process GetModuleHandleW VerifyVersionInfoW SuspendThread ResumeThread GetProcessId GetThreadContext Wow64GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID FindClose RemoveVectoredExceptionHandler GetFileSizeEx GetFileType ReadFile SetFilePointerEx FindFirstFileExW FindNextFileW GetFileTime RemoveDirectoryW MoveFileExW GetModuleFileNameW DuplicateHandle ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateEventW TerminateProcess OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx VirtualQueryEx ReadProcessMemory GetSystemTimeAsFileTime LoadLibraryW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion ReleaseSemaphore CreateSemaphoreW RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry UnhandledExceptionFilter GetSystemTime SystemTimeToFileTime FileTimeToSystemTime RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer IsDebuggerPresent FindFirstFileW GetCurrentDirectoryW OutputDebugStringA WakeConditionVariable InitializeConditionVariable SleepConditionVariableSRW GetModuleFileNameA EnterCriticalSection LeaveCriticalSection SleepEx GetFullPathNameW MoveFileExA CreateFileA GetModuleHandleA CompareFileTime WaitForSingleObjectEx GetTickCount64 TryEnterCriticalSection HeapCreate HeapFree GetDiskFreeSpaceW LockFile InitializeCriticalSection SetFilePointer GetTempPathW CreateMutexW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA VirtualQuery OutputDebugStringW FlushViewOfFile DeleteFileA HeapReAlloc HeapAlloc HeapCompact HeapDestroy UnlockFile GetFileSize GetProcessHeap CreateFileMappingW MapViewOfFile GetTickCount FlushFileBuffers GetModuleHandleExW DebugBreak GetVersionExA K32GetProcessMemoryInfo GlobalMemoryStatusEx ReleaseMutex OpenSemaphoreW CreateToolhelp32Snapshot Process32First Process32Next K32GetProcessImageFileNameA CreateProcessW CreateMutexExW CreateSemaphoreExW SwitchToThread InitializeSListHead GetStartupInfoW GetExitCodeThread GetNativeSystemInfo RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete GetStringTypeW GetLocaleInfoEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringEx GetCPInfo RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetEnvironmentVariableW ExitProcess ExitThread FreeLibraryAndExitThread SetStdHandle GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetCurrentThread IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW QueryPerformanceCounter RtlUnwind FreeLibrary GetProcAddress GetCurrentProcessorNumber GetSystemInfo CloseHandle QueryPerformanceFrequency LoadLibraryA AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFinalPathNameByHandleW GetDiskFreeSpaceExW ConvertThreadToFiberEx ConvertFiberToThread CreateSemaphoreA GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleA SetConsoleMode GetEnvironmentVariableW AddVectoredExceptionHandler GetLogicalProcessorInformation CopyFileW SetFileTime DeviceIoControl GetLastError Sleep GetEnvironmentVariableA GetFullPathNameA VirtualAlloc WriteFile WriteConsoleA GetStdHandle GetCurrentProcess VirtualFree GetConsoleScreenBufferInfo VirtualProtect GetProcessTimes InitializeSRWLock GetFileAttributesExW

crypt32

CertGetCertificateContextProperty CertOpenSystemStoreW CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore

dbghelp

SymFromAddr

user32

GetWindowLongPtrW SetWindowLongPtrW EnumDisplayDevicesA CreateWindowExW PostMessageW TranslateMessage MessageBoxW DispatchMessageW DestroyWindow GetProcessWindowStation GetUserObjectInformationW UnregisterClassW RegisterClassW GetMessageW DefWindowProcW

winmm

timeGetDevCaps timeEndPeriod timeGetTime timeSetEvent timeBeginPeriod

ws2_32

gethostbyaddr WSACloseEvent WSACreateEvent WSASetEvent WSAEventSelect WSAResetEvent send WSAWaitForMultipleEvents getsockopt inet_addr htonl closesocket socket WSAGetLastError setsockopt freeaddrinfo ntohl getaddrinfo ntohs inet_ntop inet_ntoa gethostbyname select WSASetLastError WSAEnumNetworkEvents htons getservbyport getservbyname shutdown sendto getnameinfo gethostname ioctlsocket bind listen accept WSAIoctl getpeername getsockname connect recv recvfrom WSACleanup WSAStartup __WSAFDIsSet WSASocketA

ole32

CoTaskMemFree CoCreateInstance StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx

iphlpapi

GetAdaptersAddresses if_nametoindex

shell32

SHGetFolderPathAndSubDirW

powrprof

CallNtPowerInformation

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

230KB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_4364d6cbda31597dacc3abb0e20d3965_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

PE Signature issue

advapi32

api-ms-win-core-synch-l1-2-0

kernel32

crypt32

dbghelp

user32

winmm

ws2_32

ole32

iphlpapi

shell32

powrprof

winhttp

version

generic