2026-10-19_e61ba09ca83b294a5491b22b102d3d07_chachi_cobalt-strike_coinminer_elex_glassworm_hive_icedid_lorenz_njrat_poet-rat_snatch_vidar

General

Target
2026-10-19_e61ba09ca83b294a5491b22b102d3d07_chachi_cobalt-strike_coinminer_elex_glassworm_hive_icedid_lorenz_njrat_poet-rat_snatch_vidar
Size 17.0MB
Sample261020-bf6q4stshv
SHA256 871dc8a63223af9c17f45141672443ead6fd41872224dc7d1b93e1d90f9209e4
MD5 e61ba09ca83b294a5491b22b102d3d07
SHA1 b16d260381d3eda0cffdf0f8168208532f0189e5
SHA512 857d2cd68ef827ae8791d814c39e15ac2f79fe9816ee062605e151411ea7c0345dbde3bf16c579a49743eb1013e870351c096e133f6871d43a7828940e6a8a92
SSDEEP 196608:5PuCA3TuHbMXmQe61B6FNiQ2HPGxgG2DRdJ:bOKUmQjT02HPGi
TLSH
T199077B91F8DF50B6DA03487048BB522F233469094B25DECBD6407F7AF873AE20A77659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx hacktool tunnel proxy backdoor

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

Reverse proxy tool: Chisel 1 IoCs

Chisel can be used to bypass network security and establish persistent backdoors. This open-source utility tunnels traffic through a public server to expose internal services behind NAT or firewalls.

hacktool tunnel proxy backdoor

resource	yara_rule
sample	tool_chisel

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_e61ba09ca83b294a5491b22b102d3d07_chachi_cobalt-strike_coinminer_elex_glassworm_hive_icedid_lorenz_njrat_poet-rat_snatch_vidar

File Explorer

2026-10-19_e61ba09ca83b294a5491b22b102d3d07_chachi_cobalt-strike_coinminer_elex_glassworm_hive_icedid_lorenz_njrat_poet-rat_snatch_vidar

.exe 17.0MB