2026-10-11_9b36165f4f408d6dbc5ddacb96d2d39f_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_9b36165f4f408d6dbc5ddacb96d2d39f_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
Size 16.2MB
Sample261012-sgfpras15m
SHA256 4c535913be68fcaad520fa32d4c3391b9a4c2de405809e4daf108699596d847d
MD5 9b36165f4f408d6dbc5ddacb96d2d39f
SHA1 7f626234767757d5ed57712167ee6eaadf6a8f91
SHA512 ca1fb339d9327197b27cf4579d97e3558028c0178f0a0099e7bba04a9827425daafaef451aa009d87d63efbedd6036e313cc4b56a3e42e3484a232f227efc1ed
SSDEEP 98304:YRiVE0OqYiYSEArIvRBMmndDC9RH46v/A1uRvHuwPWCex+gzmWjcRFY:qiVE0AJndDkx5v/AMRvOwPWFTyW
TLSH
T1B507AE6AB2BC00E9D4BBD17CC6469617E7B17815037057DF16A08ABA2F63BE41E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_9b36165f4f408d6dbc5ddacb96d2d39f_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-10-11_9b36165f4f408d6dbc5ddacb96d2d39f_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

.exe 16.2MB

2026-10-11_9b36165f4f408d6dbc5ddacb96d2d39f_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

IMPHASH 26fe1deed9fb09ad54de590b02a35770
SHA256 4c535913be68fcaad520fa32d4c3391b9a4c2de405809e4daf108699596d847d
MD5 9b36165f4f408d6dbc5ddacb96d2d39f
SHA1 7f626234767757d5ed57712167ee6eaadf6a8f91
SHA512 ca1fb339d9327197b27cf4579d97e3558028c0178f0a0099e7bba04a9827425daafaef451aa009d87d63efbedd6036e313cc4b56a3e42e3484a232f227efc1ed
SSDEEP 98304:YRiVE0OqYiYSEArIvRBMmndDC9RH46v/A1uRvHuwPWCex+gzmWjcRFY:qiVE0AJndDkx5v/AMRvOwPWFTyW
TLSH
T1B507AE6AB2BC00E9D4BBD17CC6469617E7B17815037057DF16A08ABA2F63BE41E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16891904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCloseKey RegOpenKeyExW RegQueryValueExA RegQueryValueExW ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyKey CryptReleaseContext CryptCreateHash CryptHashData CryptDestroyHash CryptAcquireContextW CryptGetHashParam RegOpenKeyExA ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

kernel32

SetEvent GetCurrentThreadId CreateThread WaitForSingleObject LocalFree FormatMessageA AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId GetLocalTime FormatMessageW SetLastError CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW LockFileEx SetEndOfFile UnlockFileEx SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler VerSetConditionMask IsWow64Process GetModuleHandleW VerifyVersionInfoW SuspendThread ResumeThread GetProcessId GetThreadContext Wow64GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID FindClose RemoveVectoredExceptionHandler GetFileSizeEx GetFileType ReadFile SetFilePointerEx FindFirstFileExW FindNextFileW GetFileTime RemoveDirectoryW MoveFileExW GetModuleFileNameW DuplicateHandle ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateEventW TerminateProcess OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx VirtualQueryEx ReadProcessMemory GetSystemTimeAsFileTime LoadLibraryW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion ReleaseSemaphore CreateSemaphoreW RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry UnhandledExceptionFilter GetSystemTime SystemTimeToFileTime FileTimeToSystemTime RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer IsDebuggerPresent FindFirstFileW GetCurrentDirectoryW OutputDebugStringA WakeConditionVariable InitializeConditionVariable SleepConditionVariableSRW GetModuleFileNameA EnterCriticalSection LeaveCriticalSection SleepEx GetFullPathNameW MoveFileExA CreateFileA GetModuleHandleA CompareFileTime WaitForSingleObjectEx GetTickCount64 TryEnterCriticalSection HeapCreate HeapFree GetDiskFreeSpaceW LockFile InitializeCriticalSection SetFilePointer GetTempPathW CreateMutexW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA VirtualQuery OutputDebugStringW FlushViewOfFile DeleteFileA HeapReAlloc HeapAlloc HeapCompact HeapDestroy UnlockFile GetFileSize GetProcessHeap CreateFileMappingW MapViewOfFile GetTickCount FlushFileBuffers GetModuleHandleExW DebugBreak GetVersionExA K32GetProcessMemoryInfo GlobalMemoryStatusEx ReleaseMutex OpenSemaphoreW CreateToolhelp32Snapshot Process32First Process32Next K32GetProcessImageFileNameA CreateProcessW CreateMutexExW CreateSemaphoreExW SwitchToThread InitializeSListHead GetStartupInfoW GetExitCodeThread GetNativeSystemInfo RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete GetStringTypeW GetLocaleInfoEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringEx GetCPInfo RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetEnvironmentVariableW ExitProcess ExitThread FreeLibraryAndExitThread SetStdHandle GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetCurrentThread IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW QueryPerformanceCounter RtlUnwind FreeLibrary GetProcAddress GetCurrentProcessorNumber GetSystemInfo CloseHandle QueryPerformanceFrequency LoadLibraryA AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFinalPathNameByHandleW GetDiskFreeSpaceExW ConvertThreadToFiberEx ConvertFiberToThread CreateSemaphoreA GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleA SetConsoleMode GetEnvironmentVariableW AddVectoredExceptionHandler GetLogicalProcessorInformation CopyFileW SetFileTime DeviceIoControl GetLastError Sleep GetEnvironmentVariableA GetFullPathNameA VirtualAlloc WriteFile WriteConsoleA GetStdHandle GetCurrentProcess VirtualFree GetConsoleScreenBufferInfo VirtualProtect GetProcessTimes InitializeSRWLock GetFileAttributesExW

crypt32

CertGetCertificateContextProperty CertOpenSystemStoreW CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore

dbghelp

SymFromAddr

user32

GetWindowLongPtrW SetWindowLongPtrW EnumDisplayDevicesA CreateWindowExW PostMessageW TranslateMessage MessageBoxW DispatchMessageW DestroyWindow GetProcessWindowStation GetUserObjectInformationW UnregisterClassW RegisterClassW GetMessageW DefWindowProcW

winmm

timeGetDevCaps timeEndPeriod timeGetTime timeSetEvent timeBeginPeriod

ws2_32

gethostbyaddr WSACloseEvent WSACreateEvent WSASetEvent WSAEventSelect WSAResetEvent send WSAWaitForMultipleEvents getsockopt inet_addr htonl closesocket socket WSAGetLastError setsockopt freeaddrinfo ntohl getaddrinfo ntohs inet_ntop inet_ntoa gethostbyname select WSASetLastError WSAEnumNetworkEvents htons getservbyport getservbyname shutdown sendto getnameinfo gethostname ioctlsocket bind listen accept WSAIoctl getpeername getsockname connect recv recvfrom WSACleanup WSAStartup __WSAFDIsSet WSASocketA

ole32

CoTaskMemFree CoCreateInstance StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx

iphlpapi

GetAdaptersAddresses if_nametoindex

shell32

SHGetFolderPathAndSubDirW

powrprof

CallNtPowerInformation

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

230KB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

133KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcd7cb

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_9b36165f4f408d6dbc5ddacb96d2d39f_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

advapi32

api-ms-win-core-synch-l1-2-0

kernel32

crypt32

dbghelp

user32

winmm

ws2_32

ole32

iphlpapi

shell32

powrprof

winhttp

version

generic