2026-10-23_6ef4f4456e13d81a890fde4f2bad87c6_cobalt-strike_coinminer_glassworm_helldown

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_6ef4f4456e13d81a890fde4f2bad87c6_cobalt-strike_coinminer_glassworm_helldown
Size 17.0MB
Sample261023-m5ff1abs3v
SHA256 f021a50b61cacfc5d430d045fd737bbeda715f4e758dc48c85b33fbee0a1b68b
MD5 6ef4f4456e13d81a890fde4f2bad87c6
SHA1 96cc398dae6e64e127d31c639d3c3386fbb5fab5
SHA512 04aebfd1ac4c8d811fea6f0f8b6235a38453ab1e1563a154b44c8646bc3b2f535f5b1c80f7735e4c1417ca39f817777b80cd2b9b80200d0709acd0615e29437d
SSDEEP 393216:rTj06aPJ25fsZS0A89i4DKgWqgayBhnD6NuBDqgggggggg+z:X0xGgWqgLhegggggggg
TLSH
T12C07AD9A72A011ECE477D07CD682FA0BF6F234141724A6DB07E459AC1F73BE50ABB611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_6ef4f4456e13d81a890fde4f2bad87c6_cobalt-strike_coinminer_glassworm_helldown

File Explorer

2026-10-23_6ef4f4456e13d81a890fde4f2bad87c6_cobalt-strike_coinminer_glassworm_helldown

.exe 17.0MB

2026-10-23_6ef4f4456e13d81a890fde4f2bad87c6_cobalt-strike_coinminer_glassworm_helldown

IMPHASH fef6bc44ad32b16bd7e0e5499634c6dc
SHA256 f021a50b61cacfc5d430d045fd737bbeda715f4e758dc48c85b33fbee0a1b68b
MD5 6ef4f4456e13d81a890fde4f2bad87c6
SHA1 96cc398dae6e64e127d31c639d3c3386fbb5fab5
SHA512 04aebfd1ac4c8d811fea6f0f8b6235a38453ab1e1563a154b44c8646bc3b2f535f5b1c80f7735e4c1417ca39f817777b80cd2b9b80200d0709acd0615e29437d
SSDEEP 393216:rTj06aPJ25fsZS0A89i4DKgWqgayBhnD6NuBDqgggggggg+z:X0xGgWqgLhegggggggg
TLSH
T12C07AD9A72A011ECE477D07CD682FA0BF6F234141724A6DB07E459AC1F73BE50ABB611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12010832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\pluto\Projects\t5-ios\build\windows\x64\Release\np1.pdb

d3d9

Direct3DCreate9Ex D3DPERF_BeginEvent Direct3DCreate9

d3dx9_43

D3DXGetShaderConstantTable D3DXSaveSurfaceToFileA D3DXCreateBuffer D3DXCompileShader D3DXGetShaderInputSemantics D3DXGetShaderOutputSemantics

dsound

ord6 ord11

winmm

mixerGetLineInfoA mixerGetLineControlsA mixerGetControlDetailsA mixerSetControlDetails timeEndPeriod timeBeginPeriod timeGetTime waveInGetNumDevs mixerGetNumDevs mixerOpen mixerClose

ws2_32

shutdown closesocket bind accept htons recv htonl __WSAFDIsSet WSAGetLastError WSAStartup gethostname gethostbyname setsockopt socket inet_addr connect listen ntohl sendto send select recvfrom ioctlsocket

xinput1_3

ord4 ord3 ord2

hid

HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidP_GetCaps HidD_GetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW LocalFree GetLocaleInfoEx FindFirstFileW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl GetModuleHandleW CreateDirectoryExW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle CreateDirectoryW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx GetFinalPathNameByHandleW CloseHandle ReleaseMutex WaitForSingleObject CreateMutexA Sleep CreateThread TerminateThread GetExitCodeThread GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA GetCurrentProcessId GetCurrentThreadId OpenThread CreateSymbolicLinkW ResumeThread GetThreadContext SetThreadContext CreateToolhelp32Snapshot Thread32First Thread32Next CreateFileA DeleteFileA GetFileAttributesA GetFileSize ReadFile WriteFile RtlCaptureStackBackTrace ExitProcess GetCurrentProcess VirtualUnlock K32GetProcessMemoryInfo CompareFileTime FindClose FindFirstFileA FindNextFileA GetFullPathNameA RemoveDirectoryA GetLastError GetSystemTime SystemTimeToFileTime GetCurrentThread SetThreadPriority SetThreadAffinityMask SwitchToThread DuplicateHandle RaiseException SetEvent ResetEvent CreateEventA SetThreadIdealProcessor GetProcessAffinityMask IsDebuggerPresent GetModuleFileNameA SetFileAttributesA GetFileSizeEx MapViewOfFile UnmapViewOfFile PrefetchVirtualMemory CreateFileMappingA VirtualAlloc VirtualFree VirtualQuery LoadLibraryExA FormatMessageA OutputDebugStringA OpenProcess GlobalMemoryStatus GetSystemInfo PulseEvent InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection CreateFileW GetOverlappedResult CancelIoEx CreateEventW GetTickCount64 GetCommandLineA SetUnhandledExceptionFilter SetErrorMode GetVersionExA GlobalSize Module32First Module32Next DeleteCriticalSection MulDiv SetPriorityClass SetThreadExecutionState GetSystemTimeAsFileTime GetCurrentDirectoryA GetStdHandle HeapAlloc HeapFree GetProcessHeap DebugBreak InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW SuspendThread InitializeSListHead

user32

FillRect AdjustWindowRect SetWindowTextA CloseWindow RegisterClassA RegisterWindowMessageA PostQuitMessage DefWindowProcA SendMessageA SystemParametersInfoA LoadImageA LoadIconA AttachThreadInput MoveWindow MsgWaitForMultipleObjects GetFocus CallNextHookEx GetWindowThreadProcessId GetParent CallWindowProcA MessageBoxW SetCursor LoadCursorA RegisterClassExA GetAncestor GetWindowRect PostMessageA RedrawWindow DrawTextA ChangeDisplaySettingsA EnumThreadWindows GetDesktopWindow GetWindowLongA MessageBoxA GetWindowTextA GetActiveWindow ShowCursor PeekMessageA DispatchMessageA TranslateMessage GetMessageA EnumDisplayMonitors GetMonitorInfoA MonitorFromPoint SetWindowLongA AdjustWindowRectEx GetSystemMetrics SetFocus SetWindowPos ShowWindow DestroyWindow IsWindow CreateWindowExA GetAsyncKeyState SetProcessDPIAware MonitorFromWindow ScreenToClient ClientToScreen GetCursorPos SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard MapVirtualKeyA

gdi32

CreateSolidBrush SetBkColor CreateRectRgn GdiFlush CreateDIBSection SetTextColor SetTextCharacterExtra SetBkMode SelectObject DeleteDC CreateFontA CreateCompatibleDC SetDeviceGammaRamp GetDeviceCaps DeleteObject

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

ole32

CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenThreadToken OpenProcessToken CryptGenRandom CryptReleaseContext CryptAcquireContextA

msvcp140

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z _Mtx_trylock _Thrd_yield _Cnd_do_broadcast_at_thread_exit _Cnd_signal _Cnd_broadcast _Cnd_wait _Thrd_id ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ _Thrd_join _Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_unlock _Mtx_lock _Query_perf_frequency _Query_perf_counter ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ _Thrd_hardware_concurrency ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

dwmapi

DwmIsCompositionEnabled DwmGetColorizationColor DwmEnableBlurBehindWindow

vcruntime140

__current_exception __current_exception_context __intrinsic_setjmp __std_type_info_destroy_list __C_specific_handler longjmp strchr memcmp _CxxThrowException __std_exception_destroy __std_exception_copy strstr memset memmove _purecall memchr strrchr memcpy __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

fmod floor frexp expf fmodf log logf _fdclass fmaxf tan asinf atan exp fminf pow ceil atan2f acos powf acosf sqrt lround __setusermatherr llround _dsign cosf floorf sinf ceilf nextafterf log10 sin atan2 asin ldexp atanf exp2f llroundf log2 log2f cos _fdopen log10f cbrtf tanf sqrtf _dclass

api-ms-win-crt-string-l1-1-0

iscntrl isgraph ispunct islower isupper strncpy strlen strcmp strpbrk isxdigit strspn tolower strncmp strcpy wcslen _stricmp isspace _strnicmp _strlwr strtok isalnum strcoll strncat toupper isalpha _strdup isprint isdigit

api-ms-win-crt-stdio-l1-1-0

_pclose ungetc setvbuf _ftelli64 __stdio_common_vsprintf_s _fseeki64 fopen __p__commode getc __stdio_common_vfprintf tmpnam freopen _write ferror clearerr fgets fwrite feof ftell fseek fread fflush _getcwd fclose _wfopen __acrt_iob_func _set_fmode __stdio_common_vsscanf _get_stream_buffer_pointers fgetpos fsetpos __stdio_common_vsprintf tmpfile __stdio_common_vfwprintf __stdio_common_vfwprintf_s __stdio_common_vfwprintf_p __stdio_common_vfwscanf __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vswprintf_p __stdio_common_vswscanf __stdio_common_vfprintf_s __stdio_common_vfprintf_p __stdio_common_vfscanf __stdio_common_vsnprintf_s __stdio_common_vsprintf_p __stdio_common_vsnwprintf_s fputc fgetc _popen

api-ms-win-crt-runtime-l1-1-0

_c_exit _configure_narrow_argv _seh_filter_dll exit _register_thread_local_exe_atexit_callback _errno _initialize_onexit_table _register_onexit_function _exit strerror _initterm_e _beginthreadex _execute_onexit_table terminate _crt_atexit _crt_at_quick_exit _cexit _seh_filter_exe _initterm _set_app_type _get_narrow_winmain_command_line system abort raise _initialize_narrow_environment

api-ms-win-crt-utility-l1-1-0

rand srand qsort bsearch

api-ms-win-crt-convert-l1-1-0

_itoa atoi _ui64toa _atoi64 _strtoui64 strtoull strtoll atof strtod atol

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _aligned_free _aligned_malloc malloc _callnewh _aligned_realloc calloc free

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale setlocale ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

_putenv getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _unlock_file _findfirst64i32 _findnext64i32 rename remove _mkdir _lock_file

api-ms-win-crt-time-l1-1-0

_difftime64 _mktime64 _time64 asctime _localtime64 _gmtime64 _ctime64 clock strftime

generic

count=1, id=253, version=35721,

count=10, id=260, version=35721,

count=9, id=259, version=35721,

count=6, id=257, version=35721,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=42, id=261, version=35721,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=24, id=257, version=33145,

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=173, version=30319,

count=2, id=156, version=21202,

count=3, id=123, productName=VS2005 build 50727, version=50727,

count=598, id=1, productName=Unmarked objects,

count=554, id=260, version=36260,

count=752, id=261, version=36260,

count=1, id=256, version=36260,

count=1, id=255, version=36260,

count=1, id=151,

count=1, id=258, version=36260,