2026-10-13_60b98e493aa1d9ed3ed756f3c172fdeb_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

General

Target
2026-10-13_60b98e493aa1d9ed3ed756f3c172fdeb_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 35.5MB
Sample261015-pl9a3styfz
SHA256 491a0d9c1d79e7c9277e59a7e5f8eae5c6d90ca277f12a8688b4817f2053cd35
MD5 60b98e493aa1d9ed3ed756f3c172fdeb
SHA1 0b56db30d77c8a8e8c70d2eeb3c68b70f4daf178
SHA512 a86ef0a5b4713c9ce3563d2fc3580e55009fe84844ef0edb270d0246817f281cc9c550b86a7841a52345fd268f50d25233bf584f06f88f8999a6b6a0788f02f6
SSDEEP 24576:A2ElbueOhyjcgjqvlcSr6Kop0ikYCwZYgt7:A2E0efcpi03YC+YE7
TLSH
T14D87091E0FCFCCCFA48524640FA0EE3D922E757954018B49CAA24785B599FE46FE239D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-13_60b98e493aa1d9ed3ed756f3c172fdeb_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-10-13_60b98e493aa1d9ed3ed756f3c172fdeb_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 35.5MB

2026-10-13_60b98e493aa1d9ed3ed756f3c172fdeb_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH 871261d47f2a7204d3e68778a25a7bf7
SHA256 491a0d9c1d79e7c9277e59a7e5f8eae5c6d90ca277f12a8688b4817f2053cd35
MD5 60b98e493aa1d9ed3ed756f3c172fdeb
SHA1 0b56db30d77c8a8e8c70d2eeb3c68b70f4daf178
SHA512 a86ef0a5b4713c9ce3563d2fc3580e55009fe84844ef0edb270d0246817f281cc9c550b86a7841a52345fd268f50d25233bf584f06f88f8999a6b6a0788f02f6
SSDEEP 24576:A2ElbueOhyjcgjqvlcSr6Kop0ikYCwZYgt7:A2E0efcpi03YC+YE7
TLSH
T14D87091E0FCFCCCFA48524640FA0EE3D922E757954018B49CAA24785B599FE46FE239D
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c5:4d:4a:8c:fc:2f:71:16:ed:6f:1f:e8:83:c9:f4:54:86:18:68:67:57:d6:46:91:44:e5:a7:54:7c:13:2b:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Oct 7, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

PE Signature issue

Digest

09:8e:33:47:21:74:50:1f:5b:c5:1b:9a:7a:2a:7f:91:26:4a:cf:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Oct 7, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Minor OS version

0

Major OS version

6

Entry point

29388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle WriteConsoleW HeapSize GetProcAddress GetModuleHandleA DeleteFileW ExitProcess LoadLibraryA FreeLibrary GetLastError SizeofResource FindResourceA FormatMessageW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetFullPathNameW GetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent RtlUnwind InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateFileW GetFileType GetModuleHandleExW ReadFile GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapFree HeapAlloc FlushFileBuffers GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetStdHandle SetEndOfFile GetFileAttributesExW

user32

LoadStringA

Name

.text

Size

776KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

34.5MB

Virtual Size

34.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_60b98e493aa1d9ed3ed756f3c172fdeb_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

PE Signature issue

PE Signature issue

kernel32

user32

generic