2026-10-29_1a3dce1c7d8f0aaac1e46a4aab318bf2_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-29_1a3dce1c7d8f0aaac1e46a4aab318bf2_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
Size 13.1MB
Sample261029-vcxhtaev6q
SHA256 ae96e0505e1b61b7a51cae44aee24df6f41d4a6af17defe9e06dae135d23ea33
MD5 1a3dce1c7d8f0aaac1e46a4aab318bf2
SHA1 c5f8eda22cee479d500d7366d0e664c1b77722f7
SHA512 38087fff77ff87c907456cea72e27fc329b7da6deb1e922233e731201a99e250424db6a51c949779cc816286674cdf4f95f21c1c2550631dfef9b3ef1affdf58
SSDEEP 98304:n/J6JioBDtBJDGX9pMu9zJ6wZLHXTG78AOYBi80F6vPFHa+7+FdqbgILaezh:x6UoBDtBJwZLHXTC8ANBi8I6v96IMq3
TLSH
T1ACD6AE6AA2BC00E9D4BBD178C6569617E7B17815037067DF16A04ABA2F23FE05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-29_1a3dce1c7d8f0aaac1e46a4aab318bf2_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-10-29_1a3dce1c7d8f0aaac1e46a4aab318bf2_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

.exe 13.1MB

2026-10-29_1a3dce1c7d8f0aaac1e46a4aab318bf2_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

IMPHASH d3c5c0fecbd6080b6238c70bd53e0d77
SHA256 ae96e0505e1b61b7a51cae44aee24df6f41d4a6af17defe9e06dae135d23ea33
MD5 1a3dce1c7d8f0aaac1e46a4aab318bf2
SHA1 c5f8eda22cee479d500d7366d0e664c1b77722f7
SHA512 38087fff77ff87c907456cea72e27fc329b7da6deb1e922233e731201a99e250424db6a51c949779cc816286674cdf4f95f21c1c2550631dfef9b3ef1affdf58
SSDEEP 98304:n/J6JioBDtBJDGX9pMu9zJ6wZLHXTG78AOYBi80F6vPFHa+7+FdqbgILaezh:x6UoBDtBJwZLHXTC8ANBi8I6v96IMq3
TLSH
T1ACD6AE6AA2BC00E9D4BBD178C6569617E7B17815037067DF16A04ABA2F23FE05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

86:bd:63:e4:8e:45:5a:b4:60:bf:4b:db:aa:84:da:58:58:09:6b:d0:58:b5:b8:5e:67:2f:d1:8d:be:36:64:f9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7062956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildAgent\work\gameenginebuck2------43\buck-out\v2\art\root\16dc16a89ac428ad\Client\CrashReport\___loader.exe__\RobloxCrashHandler.pdb

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCloseKey RegOpenKeyExW RegQueryValueExA RegQueryValueExW ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW BuildExplicitAccessWithNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyKey CryptReleaseContext CryptCreateHash CryptHashData CryptDestroyHash CryptAcquireContextW CryptGetHashParam RegOpenKeyExA ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

kernel32

GetCurrentThreadId CreateThread WaitForSingleObject AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId GetLocalTime FormatMessageW SetLastError CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW LockFileEx SetEndOfFile UnlockFileEx SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler VerSetConditionMask IsWow64Process GetModuleHandleW FormatMessageA VerifyVersionInfoW SuspendThread ResumeThread GetProcessId GetThreadContext Wow64GetThreadContext IsProcessorFeaturePresent GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID FindClose RemoveVectoredExceptionHandler GetFileSizeEx GetFileType ReadFile SetFilePointerEx FindFirstFileExW FindNextFileW GetFileTime RemoveDirectoryW MoveFileExW GetModuleFileNameW DuplicateHandle ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetEvent CreateEventW TerminateProcess OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx VirtualQueryEx ReadProcessMemory GetSystemTimeAsFileTime LoadLibraryW LocalFree SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion ReleaseSemaphore CreateSemaphoreW RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry UnhandledExceptionFilter GetSystemTime SystemTimeToFileTime FileTimeToSystemTime RaiseException InitializeCriticalSectionEx DeleteCriticalSection DecodePointer IsDebuggerPresent FindFirstFileW GetCurrentDirectoryW OutputDebugStringA WakeConditionVariable InitializeConditionVariable SleepConditionVariableSRW GetModuleFileNameA EnterCriticalSection LeaveCriticalSection SleepEx GetFullPathNameW MoveFileExA GetModuleHandleA CompareFileTime WaitForSingleObjectEx GetTickCount64 TryEnterCriticalSection HeapCreate HeapFree TryAcquireSRWLockExclusive InitializeCriticalSection GetTempPathW UnmapViewOfFile HeapValidate HeapSize GetFileAttributesExW FlushViewOfFile HeapReAlloc VirtualQuery GetOverlappedResult HeapCompact HeapDestroy GetProcessHeap CreateFileMappingW MapViewOfFile GetDriveTypeW FlushFileBuffers GetModuleHandleExW DebugBreak GetVersionExA K32GetProcessMemoryInfo GlobalMemoryStatusEx OutputDebugStringW ReleaseMutex OpenSemaphoreW CreateToolhelp32Snapshot Process32First Process32Next K32GetProcessImageFileNameA CreateProcessW CreateMutexExW CreateSemaphoreExW SwitchToThread ResetEvent SetFilePointer InitializeSListHead GetStartupInfoW GetExitCodeThread GetNativeSystemInfo RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete GetStringTypeW GetLocaleInfoEx WakeAllConditionVariable EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringEx GetCPInfo RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetEnvironmentVariableW ExitProcess ExitThread FreeLibraryAndExitThread SetStdHandle GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetCurrentThread IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW QueryPerformanceCounter RtlUnwind FreeLibrary GetProcAddress GetCurrentProcessorNumber GetSystemInfo CloseHandle QueryPerformanceFrequency LoadLibraryA AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFinalPathNameByHandleW GetDiskFreeSpaceExW ConvertThreadToFiberEx ConvertFiberToThread CreateSemaphoreA GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleA SetConsoleMode GetEnvironmentVariableW AddVectoredExceptionHandler GetLogicalProcessorInformation CopyFileW SetFileTime DeviceIoControl GetLastError Sleep GetEnvironmentVariableA VirtualAlloc WriteFile WriteConsoleA GetStdHandle GetCurrentProcess VirtualFree GetConsoleScreenBufferInfo VirtualProtect GetProcessTimes InitializeSRWLock HeapAlloc

crypt32

CertGetCertificateContextProperty CertOpenSystemStoreW CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore

dbghelp

SymFromAddr

user32

SetWindowLongPtrW EnumDisplayDevicesA GetMessageW DestroyWindow TranslateMessage DispatchMessageW MessageBoxW GetWindowLongPtrW GetProcessWindowStation GetUserObjectInformationW CreateWindowExW UnregisterClassW RegisterClassW PostMessageW DefWindowProcW

winmm

timeGetDevCaps timeEndPeriod timeGetTime timeSetEvent timeBeginPeriod

ws2_32

gethostbyaddr WSACloseEvent WSACreateEvent WSASetEvent WSAEventSelect WSAResetEvent send WSAWaitForMultipleEvents getsockopt inet_addr htonl closesocket socket WSAGetLastError freeaddrinfo ntohl getaddrinfo setsockopt ntohs inet_ntop inet_ntoa gethostbyname select WSASetLastError WSAEnumNetworkEvents htons getservbyport getservbyname shutdown sendto getnameinfo gethostname ioctlsocket bind listen accept WSAIoctl getpeername getsockname connect recv recvfrom WSACleanup WSAStartup __WSAFDIsSet WSASocketA

ole32

CoTaskMemFree CoCreateInstance StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeEx

iphlpapi

GetAdaptersAddresses if_nametoindex

shell32

SHGetFolderPathAndSubDirW

powrprof

CallNtPowerInformation

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

9.6MB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

231KB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

373KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-29_1a3dce1c7d8f0aaac1e46a4aab318bf2_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar

PE Signature issue

advapi32

api-ms-win-core-synch-l1-2-0

kernel32

crypt32

dbghelp

user32

winmm

ws2_32

ole32

iphlpapi

shell32

powrprof

winhttp

version

generic