Overview

overview

10

Static

static

10

2026-11-01...om.exe

windows10-2004-x64

5

2026-11-01...om.exe

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-11-01_cff0d818e72945f10ee920f9cc959443_cobalt-strike_coinminer_glassworm_icedid_satacom
  • Size 5.7MB
  • Sample261102-j2xdkags4x
  • SHA256 add5952e6dea34e344c41a8020400478fea5dfbbd15b3606a8fe5be30d61d659
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
agilenet

Malware Config

Signatures

  • Detects .NET executables developed using Bonsai 1 IoCs
  • Detects LLVM obfuscator/loader 1 IoCs
  • Detects TriumphLoader 1 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
  • Detects executables built or packed with LSD packer 1 IoCs
  • Detects executables built or packed with LibZ 1 IoCs
  • Detects executables built or packed with MPress PE compressor 1 IoCs
  • Detects executables built or packed with Nate packer 1 IoCs
  • Detects executables built or packed with PS2EXE 1 IoCs
  • Detects executables manipulated with Fody 1 IoCs
  • Detects executables packed with 9Rays.Net Spices.Net Obfuscator. 1 IoCs
  • Detects executables packed with Agile.NET / CliSecure 1 IoCs
  • Detects executables packed with AspireCrypt 1 IoCs
  • Detects executables packed with Babel 1 IoCs
  • Detects executables packed with BoxedApp 1 IoCs
  • Detects executables packed with Cassandra/CyaX 1 IoCs
  • Detects executables packed with ConfuserEx Mod 1 IoCs
  • Detects executables packed with ConfuserEx Mod Beds Protector 1 IoCs
  • Detects executables packed with ConfuserEx Mod Trinity Protector 1 IoCs
  • Detects executables packed with Costura DotNetGuard 1 IoCs
  • Detects executables packed with DNGuard 1 IoCs
  • Detects executables packed with Dotfuscator 1 IoCs
  • Detects executables packed with Enigma 1 IoCs
  • Detects executables packed with Goliath 1 IoCs
  • Detects executables packed with NETProtect.IO 1 IoCs
  • Detects executables packed with NoopyProtect 1 IoCs
  • Detects executables packed with RLPACK 1 IoCs
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs
  • Detects executables packed with SmartAssembly 1 IoCs
  • Detects executables packed with Themida 1 IoCs
  • Detects executables packed with VMProtect. 1 IoCs
  • Detects executables packed with Yano Obfuscator 1 IoCs
  • Detects executables packed with dotNetProtector 1 IoCs
  • Detects executables packed with eXPressor 1 IoCs
  • Detects executables packed with nBinder 1 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Detects executables referencing many IR and analysis tools 1 IoCs
  • Detects files packed with Allatori Java Obfuscator 1 IoCs
  • Detects python code potentially obfuscated using PyMinifier 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 2026-11-01_cff0d818e72945f10ee920f9cc959443_cobalt-strike_coinminer_glassworm_icedid_satacom
    .exe 5.7MB

2026-11-01_cff0d818e72945f10ee920f9cc959443_cobalt-strike_coinminer_glassworm_icedid_satacom

  • IMPHASH 4d947d320d98687f7d300a8065d877ef
  • SHA256 add5952e6dea34e344c41a8020400478fea5dfbbd15b3606a8fe5be30d61d659
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx64arch:x64

  • Detects .NET executables developed using Bonsai

  • Detects LLVM obfuscator/loader

  • Detects TriumphLoader

  • Detects executables (downlaoders) containing URLs to raw contents of a paste

  • Detects executables built or packed with LSD packer

  • Detects executables built or packed with LibZ

  • Detects executables built or packed with MPress PE compressor

  • Detects executables built or packed with Nate packer

  • Detects executables built or packed with PS2EXE

  • Detects executables manipulated with Fody

  • Detects executables packed with 9Rays.Net Spices.Net Obfuscator.

  • Detects executables packed with Agile.NET / CliSecure

  • Detects executables packed with AspireCrypt

  • Detects executables packed with Babel

  • Detects executables packed with BoxedApp

  • Detects executables packed with Cassandra/CyaX

  • Detects executables packed with ConfuserEx Mod

  • Detects executables packed with ConfuserEx Mod Beds Protector

  • Detects executables packed with ConfuserEx Mod Trinity Protector

  • Detects executables packed with Costura DotNetGuard

  • Detects executables packed with DNGuard

  • Detects executables packed with Dotfuscator

  • Detects executables packed with Enigma

  • Detects executables packed with Goliath

  • Detects executables packed with NETProtect.IO

  • Detects executables packed with NoopyProtect

  • Detects executables packed with RLPACK

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Detects executables packed with SmartAssembly

  • Detects executables packed with Themida

  • Detects executables packed with VMProtect.

  • Detects executables packed with Yano Obfuscator

  • Detects executables packed with dotNetProtector

  • Detects executables packed with eXPressor

  • Detects executables packed with nBinder

  • Detects executables packed with or use KoiVM

  • Detects executables referencing many IR and analysis tools

  • Detects files packed with Allatori Java Obfuscator

  • Detects python code potentially obfuscated using PyMinifier

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
4260928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths