2026-10-08_62c76b67b4f53fc033317cedaed84c12_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

Resubmissions

12/10/2026, 15:25

261012-st3eaaf15p

09/10/2026, 13:19

261009-qkpeysw1gx10

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_62c76b67b4f53fc033317cedaed84c12_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
Size 12.9MB
Sample261012-st3eaaf15p
SHA256 bbdac8da525c3e266a3ef84c77f15bc84b1df2cce40aa27b99a50d9df37ca401
MD5 62c76b67b4f53fc033317cedaed84c12
SHA1 b7d0f7b88539e526873a0cb27fc6a40945a765f7
SHA512 080a55489e6ea7bb245bd5de8c88b536a451d7b2055fb8db5b91e0da8616a58dcb284c0acc9978cfd1835ba85f3cc35991f460eed491915c4ebbce74af6157f4
SSDEEP 196608:XH0yYacW2V9GGRiHuSfMGg5OgvbM9vK+5tF344XEdK1:XD+JV8uS075OgzM9HF+K1
TLSH
T197D69D6AA2B800E8D4BBD178CA565613E7B1B41603709BDF1BA046F61F63BE45F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-08_62c76b67b4f53fc033317cedaed84c12_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-10-08_62c76b67b4f53fc033317cedaed84c12_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

.exe 12.9MB

2026-10-08_62c76b67b4f53fc033317cedaed84c12_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

IMPHASH e2047c2b0c33012c85fd6a99dc9b80a0
SHA256 bbdac8da525c3e266a3ef84c77f15bc84b1df2cce40aa27b99a50d9df37ca401
MD5 62c76b67b4f53fc033317cedaed84c12
SHA1 b7d0f7b88539e526873a0cb27fc6a40945a765f7
SHA512 080a55489e6ea7bb245bd5de8c88b536a451d7b2055fb8db5b91e0da8616a58dcb284c0acc9978cfd1835ba85f3cc35991f460eed491915c4ebbce74af6157f4
SSDEEP 196608:XH0yYacW2V9GGRiHuSfMGg5OgvbM9vK+5tF344XEdK1:XD+JV8uS075OgzM9HF+K1
TLSH
T197D69D6AA2B800E8D4BBD178CA565613E7B1B41603709BDF1BA046F61F63BE45F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b9:cb:33:e0:38:49:ff:84:a0:ab:c2:00:ce:12:5a:56:f9:ad:02:62:c4:20:fd:a0:fa:27:c1:ca:e5:47:3c:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6352112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildAgent\work\gameenginebuck2------43\buck-out\v2\art\root\7dac51b84e13a6d2\Client\Installer\Windows\___RobloxPlayerInstaller.exe__\RobloxPlayerInstaller.pdb

kernel32

OutputDebugStringA LoadLibraryA GetSystemTimeAsFileTime GetVersionExA GetExitCodeProcess MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next GetModuleHandleA SetEndOfFile SetFilePointer FlushViewOfFile WriteConsoleW LocalFree FormatMessageA GetCurrentDirectoryW CreateDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileTime GetFullPathNameW RemoveDirectoryW SetFilePointerEx SetFileTime GetTempPathW DeviceIoControl CopyFileW MoveFileExW AreFileApisANSI WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW LoadLibraryW VirtualQuery FlushFileBuffers GetTickCount LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW WriteFile HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx MoveFileExA CompareFileTime GetEnvironmentVariableA GetTickCount64 InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW FreeLibrary FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree LocalAlloc GlobalUnlock K32GetProcessMemoryInfo GetFileSizeEx CompareStringEx GetSystemFirmwareTable GetDriveTypeW CreateFile2 InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind ReadFile GetStartupInfoW GetStringTypeW SwitchToThread GetExitCodeThread WakeAllConditionVariable SleepConditionVariableCS RtlPcToFileHeader GetLocaleInfoEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetCPInfo RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle GetFileType ExitProcess PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP GetConsoleMode SetEnvironmentVariableW ReadConsoleW GetStdHandle GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapQueryInformation SetConsoleCtrlHandler FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW GetSystemTime SetThreadDescription CreateThread VirtualFree VirtualProtect VirtualAlloc GetSystemInfo GetCurrentProcessorNumber QueryPerformanceCounter QueryPerformanceFrequency SetSearchPathMode GlobalMemoryStatusEx GlobalLock CreateProcessW GetCurrentThread OpenEventW CreateEventW SetUnhandledExceptionFilter SetEvent Sleep K32GetModuleFileNameExW Process32NextW Process32FirstW CreateToolhelp32Snapshot SystemTimeToFileTime RtlUnwind GetFinalPathNameByHandleW InitOnceComplete InitOnceBeginInitialize ConvertThreadToFiberEx ConvertFiberToThread CreateSemaphoreA GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleA SetConsoleMode GetLogicalProcessorInformation GetCurrentProcess GetModuleFileNameW GetFileSize GetFileInformationByHandleEx OpenProcess UpdateProcThreadAttribute InitializeProcThreadAttributeList TerminateProcess SetFileAttributesW GetFileAttributesW DeleteFileW UnmapViewOfFile IsProcessorFeaturePresent MapViewOfFile UnhandledExceptionFilter GetVolumePathNameW CreateWaitableTimerW CancelWaitableTimer SetWaitableTimer GetUserDefaultLocaleName LocaleNameToLCID VerifyVersionInfoW CreateFileMappingW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose VerSetConditionMask FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent GetEnvironmentVariableW GetCommandLineW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenSystemStoreW CertDuplicateCertificateContext CertOpenStore CertFindCertificateInStore CertGetCertificateContextProperty

iphlpapi

GetAdaptersAddresses if_nametoindex

ole32

CoInitializeEx CoUninitialize CoCreateInstance StringFromGUID2 CoCreateGuid CoTaskMemAlloc CoTaskMemFree

powrprof

CallNtPowerInformation

user32

CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow GetSystemMetrics DrawTextW RegisterClassW EndPaint InvalidateRect GetClientRect GetWindowRect FillRect GetWindowLongW CallWindowProcW PostQuitMessage GetWindowLongPtrW DefWindowProcW MessageBoxW BeginPaint SendMessageW LoadIconW DestroyIcon GetProcessWindowStation GetUserObjectInformationW GetMessageW TranslateMessage LoadBitmapW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW SetWindowLongPtrW

ws2_32

connect accept WSACleanup WSAStartup recvfrom getsockname getpeername WSAIoctl getservbyname getservbyport gethostbyaddr htons inet_ntoa inet_addr gethostbyname getnameinfo gethostname shutdown sendto select bind listen WSASocketA __WSAFDIsSet closesocket ntohl ntohs setsockopt socket WSAGetLastError getaddrinfo freeaddrinfo inet_ntop htonl getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent WSAWaitForMultipleEvents recv WSASetLastError ioctlsocket

advapi32

ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetTokenInformation IsValidSid SystemFunction036 CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW GetUserNameW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

comctl32

InitCommonControlsEx _TrackMouseEvent TaskDialogIndirect

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

gdi32

SetTextColor SetBkMode SetDCPenColor SetDCBrushColor SelectObject Rectangle GetStockObject DeleteObject CreateFontW CreateSolidBrush

shlwapi

ord12 PathFindFileNameW PathFindExtensionW

winmm

timeBeginPeriod timeGetTime timeGetDevCaps timeEndPeriod timeSetEvent

dbghelp

SymFromAddr

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCloneImage GdipFree

uxtheme

SetWindowTheme

Name

.text

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

230KB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

410KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

293KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_62c76b67b4f53fc033317cedaed84c12_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

PE Signature issue

kernel32

crypt32

iphlpapi

ole32

powrprof

user32

ws2_32

advapi32

api-ms-win-core-synch-l1-2-0

comctl32

shell32

gdi32

shlwapi

winmm

dbghelp

gdiplus

uxtheme

generic