2026-11-06_c825afd66e9d84b4f1ef1858805bc223_cobalt-strike_coinminer_glassworm_icedid_njrat_ryuk_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_c825afd66e9d84b4f1ef1858805bc223_cobalt-strike_coinminer_glassworm_icedid_njrat_ryuk_satacom_stealc
Size 3.7MB
Sample261107-3pmhdags4w
SHA256 2bb15af52f6a543f35a0203d3bd4244f74d21dd8a80da811d9ac4408c07d407f
MD5 c825afd66e9d84b4f1ef1858805bc223
SHA1 909dda4dbfb7e77e4cb7fe3e56a5dd5d9cfcd1fd
SHA512 06e82a380d8310afbfb252296d7fc761c7f52ffcbd9b2a95c90eecdf9eacf67052fcf27a779323225f9d896f9c3dc615fcdd5ad034d20eaf5c20dc20a0e4e58b
SSDEEP 49152:OqWPkSAGoiRedJTRzejCDaYZGS9OVo2liVPJZzs6CQL07+/ABf+JWCILz2:VikJbiMJTPwti9vAd+D
TLSH
T144069E06719564FDC49AC034574B5AA3AE35388A5F317AFF528496352FB2AF01F3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_c825afd66e9d84b4f1ef1858805bc223_cobalt-strike_coinminer_glassworm_icedid_njrat_ryuk_satacom_stealc

File Explorer

2026-11-06_c825afd66e9d84b4f1ef1858805bc223_cobalt-strike_coinminer_glassworm_icedid_njrat_ryuk_satacom_stealc

.exe 3.7MB

2026-11-06_c825afd66e9d84b4f1ef1858805bc223_cobalt-strike_coinminer_glassworm_icedid_njrat_ryuk_satacom_stealc

IMPHASH da0e6eca540267244349fb92beeaaf38
SHA256 2bb15af52f6a543f35a0203d3bd4244f74d21dd8a80da811d9ac4408c07d407f
MD5 c825afd66e9d84b4f1ef1858805bc223
SHA1 909dda4dbfb7e77e4cb7fe3e56a5dd5d9cfcd1fd
SHA512 06e82a380d8310afbfb252296d7fc761c7f52ffcbd9b2a95c90eecdf9eacf67052fcf27a779323225f9d896f9c3dc615fcdd5ad034d20eaf5c20dc20a0e4e58b
SSDEEP 49152:OqWPkSAGoiRedJTRzejCDaYZGS9OVo2liVPJZzs6CQL07+/ABf+JWCILz2:VikJbiMJTPwti9vAd+D
TLSH
T144069E06719564FDC49AC034574B5AA3AE35388A5F317AFF528496352FB2AF01F3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2597200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringW ConvertFiberToThread CreateDirectoryW CreateFile2 CreateFileMappingW CreateFileW CreateMutexW CreateProcessW DecodePointer DeleteCriticalSection DeleteFiber EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive RtlAddFunctionTable RtlCaptureContext RtlDeleteFunctionTable RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetEndOfFile SetEnvironmentVariableW SetErrorMode SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

libclang

clang_Cursor_getOffsetOfField clang_Cursor_isAnonymousRecordDecl clang_Cursor_isNull clang_Type_getAlignOf clang_Type_getNamedType clang_Type_getSizeOf clang_Type_visitFields clang_createIndex clang_defaultDiagnosticDisplayOptions clang_disposeDiagnostic clang_disposeIndex clang_disposeString clang_disposeTokens clang_disposeTranslationUnit clang_equalTypes clang_formatDiagnostic clang_getArgType clang_getArrayElementType clang_getArraySize clang_getCString clang_getCanonicalType clang_getCursorDefinition clang_getCursorKind clang_getCursorLocation clang_getCursorSpelling clang_getCursorType clang_getDiagnostic clang_getDiagnosticLocation clang_getDiagnosticSeverity clang_getEnumConstantDeclUnsignedValue clang_getEnumConstantDeclValue clang_getEnumDeclIntegerType clang_getFieldDeclBitWidth clang_getFunctionTypeCallingConv clang_getInclusions clang_getLocationForOffset clang_getNumArgTypes clang_getNumDiagnostics clang_getPointeeType clang_getResultType clang_getSpellingLocation clang_getToken clang_getTokenKind clang_getTokenSpelling clang_getTranslationUnitCursor clang_getTypeDeclaration clang_getTypeSpelling clang_getTypedefDeclUnderlyingType clang_isConstQualifiedType clang_isFunctionTypeVariadic clang_isRestrictQualifiedType clang_isVolatileQualifiedType clang_parseTranslationUnit2 clang_visitChildren

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA

advapi32

DeregisterEventSource RegisterEventSourceA ReportEventA

bcrypt

BCryptGenRandom

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

903KB

Virtual Size

903KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_c825afd66e9d84b4f1ef1858805bc223_cobalt-strike_coinminer_glassworm_icedid_njrat_ryuk_satacom_stealc

kernel32

libclang

user32

advapi32

bcrypt

generic