2026-11-01_efce07e80b1e821ac7c745a8de6ed704_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_efce07e80b1e821ac7c745a8de6ed704_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 3.8MB
Sample261102-eash3szxgx
SHA256 a486027d15daf5b14c846d57baa7000760fa962b00d86471d0d8b279dfe20379
MD5 efce07e80b1e821ac7c745a8de6ed704
SHA1 4ab77a3d87d639cf17411a357147d4a7a2bd8ef9
SHA512 5adeeeeea312b4920c751009543baf1774c70d84714ca45d717c0948f79aa5fe80191cdc2042f4080d305e839c923e088a7370192cbaf8b84d4beb82d2ef4b0a
SSDEEP 49152:xB4v9WjlLe4U/YJ6J0dO0r2AJO0yYy20QYTu5dPkLoJjbsTpt9WTbZK3Fc:YAjlc/+J5Hy2/+LoJjbsNCTN82
TLSH
T12306AE22B16800DAD977D4B88A8B8523E7F07859137197CF12B5AB2A1F677F41E3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_efce07e80b1e821ac7c745a8de6ed704_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-11-01_efce07e80b1e821ac7c745a8de6ed704_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 3.8MB

2026-11-01_efce07e80b1e821ac7c745a8de6ed704_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH 7b59991952e14875d84193e7789b7311
SHA256 a486027d15daf5b14c846d57baa7000760fa962b00d86471d0d8b279dfe20379
MD5 efce07e80b1e821ac7c745a8de6ed704
SHA1 4ab77a3d87d639cf17411a357147d4a7a2bd8ef9
SHA512 5adeeeeea312b4920c751009543baf1774c70d84714ca45d717c0948f79aa5fe80191cdc2042f4080d305e839c923e088a7370192cbaf8b84d4beb82d2ef4b0a
SSDEEP 49152:xB4v9WjlLe4U/YJ6J0dO0r2AJO0yYy20QYTu5dPkLoJjbsTpt9WTbZK3Fc:YAjlc/+J5Hy2/+LoJjbsNCTN82
TLSH
T12306AE22B16800DAD977D4B88A8B8523E7F07859137197CF12B5AB2A1F677F41E3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1838544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Tools\agent\workspace\wechat_player_v395\out\x64\Release\bin\WeChatPlayer.pdb

advapi32

RegOpenKeyExW RegCloseKey CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW CryptEnumProvidersW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

shlwapi

PathRemoveFileSpecW PathFileExistsW

user32

GetUserObjectInformationW TranslateMessage GetQueueStatus MsgWaitForMultipleObjectsEx KillTimer PostQuitMessage PeekMessageW SetTimer GetProcessWindowStation DefWindowProcW UnregisterClassW PostMessageW SetProcessDPIAware DispatchMessageW DestroyWindow SetWindowLongPtrW CreateWindowExW GetWindowLongPtrW RegisterClassExW MessageBoxW

tpthumbplayer

TPGetPlayerFactory TPBuildBoolParam TPGetUtilsFactory TPBuildArrayParam TPGetTPPlayerManager TPGetCapabilityFactory TPGetDownloadProxyFactory TPGetAssetFactory TPBuildStringParam TPBuildLongParam

kernel32

GetCurrentThreadId SuspendThread UnmapViewOfFile DuplicateHandle HeapSize CreateToolhelp32Snapshot CreateEventW GetLastError LockResource HeapReAlloc CloseHandle RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc Module32FirstW DecodePointer HeapDestroy GetProcAddress VirtualAllocEx DeleteCriticalSection ReadProcessMemory GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW Module32NextW CreateFileMappingW MapViewOfFile GetTickCount VirtualQuery OpenThread SetUnhandledExceptionFilter LoadLibraryW GetLocalTime WideCharToMultiByte OpenFileMappingA MultiByteToWideChar Sleep GetCommandLineW LocalFree SetLastError WriteFile DeleteFileW FormatMessageA ReadFile GetFileSizeEx SetEndOfFile GetFileInformationByHandle SetFilePointerEx FlushFileBuffers SetThreadPriority FileTimeToSystemTime GetCurrentThread QueryPerformanceFrequency GetThreadPriority SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort WaitForSingleObject CreateThread GetThreadId IsDebuggerPresent TlsGetValue TryEnterCriticalSection InitializeCriticalSectionAndSpinCount GetDiskFreeSpaceExW RtlCaptureStackBackTrace ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared GetProcessTimes GetModuleHandleExW SetEvent ResetEvent TerminateProcess TlsAlloc CreateFileW GetModuleHandleA GetSystemInfo GetVersionExW GetNativeSystemInfo CreateDirectoryW RemoveDirectoryW GetFileAttributesW GetFileAttributesExW GetCurrentDirectoryW FindFirstFileExW FindNextFileW FindClose SwitchToThread CreateSemaphoreA CreateEventA WaitForSingleObjectEx ReleaseSemaphore CreateFileA GetFileSize SetFilePointer MapViewOfFileEx CreateFileMappingA GetEnvironmentVariableW FindFirstFileW GetFileTime GetFullPathNameW DeviceIoControl SetWaitableTimer CreateWaitableTimerW OpenEventA WaitForMultipleObjectsEx AreFileApisANSI GetStdHandle GetFileType DeleteFiber ConvertFiberToThread FreeLibrary LoadLibraryA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SetStdHandle ExitProcess GetConsoleOutputCP LoadLibraryExW RtlPcToFileHeader RtlUnwindEx Thread32First InitializeCriticalSectionEx SetErrorMode InitializeCriticalSection LeaveCriticalSection Thread32Next WaitForMultipleObjects TlsFree InitializeSListHead GetStartupInfoW GetCurrentProcess EnterCriticalSection HeapFree WriteProcessMemory SearchPathW SizeofResource GetTimeZoneInformation SetConsoleCtrlHandler GetDriveTypeW PeekNamedPipe GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetModuleFileNameW TlsSetValue IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer InitializeSRWLock OutputDebugStringW LoadLibraryExA VirtualProtect RtlUnwind

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

ws2_32

closesocket WSACleanup WSAGetLastError recv WSASetLastError send

shell32

CommandLineToArgvW

dbghelp

SymSetSearchPathW SymGetLineFromAddr64 SymInitialize SymGetSearchPathW SymSetOptions SymFromAddr

winmm

timeGetTime timeBeginPeriod timeEndPeriod

ole32

CoInitializeEx CoUninitialize

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

719KB

Virtual Size

718KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

413KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=15, id=259, version=28900,

count=200, id=261, version=28900,

count=22, id=260, version=28900,

count=1, id=253, version=28518,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=97, id=261, version=30034,

count=504, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,

count=27, id=261, version=30145,

count=27, id=260, version=30145,

count=2, id=257, version=27051,

count=10, id=261, version=31332,

count=29, id=257, version=28900,

count=416, id=1, productName=Unmarked objects,

count=206, id=265, version=30153,

count=1, id=256, version=30153,

count=1, id=255, version=30153,

count=1, id=151,

count=1, id=258, version=30153,