2026-11-10_b9c3319c0ee4d65409c9cfc4fe05a691_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar

General

Target
2026-11-10_b9c3319c0ee4d65409c9cfc4fe05a691_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar
Size 35.7MB
Sample261111-1v17lscc38
SHA256 7e0b2dee623f624b959447faea36f8ef0672d159540ac2f0626726b2621a7a93
MD5 b9c3319c0ee4d65409c9cfc4fe05a691
SHA1 1fd3077eba73f1796f5febfb9ac3d12f98a9d6eb
SHA512 71912c42fc56b9d3d8e6f89d3d97b40491767343d86f78a95222db687f2ffb88d6479c4cd9e1d21b25d0524aae65e19f0b944dfe15bcfef4e02f1a79f48fcc4f
SSDEEP 98304:tFoG4QOye2FHAQfMArIeBTg07h27e09X6rS+BVcruRYk7VCXWxA:tMQh3fMArbdA
TLSH
T159870C427742D962D8540A7B8C9ADBC82371FD8AEE06630738C6772F2EB66C7DD03495
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_b9c3319c0ee4d65409c9cfc4fe05a691_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar

File Explorer

2026-11-10_b9c3319c0ee4d65409c9cfc4fe05a691_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar

.exe 35.7MB

2026-11-10_b9c3319c0ee4d65409c9cfc4fe05a691_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar

IMPHASH 20abbe0f6ab059ea4a375bcb6b8a717b
SHA256 7e0b2dee623f624b959447faea36f8ef0672d159540ac2f0626726b2621a7a93
MD5 b9c3319c0ee4d65409c9cfc4fe05a691
SHA1 1fd3077eba73f1796f5febfb9ac3d12f98a9d6eb
SHA512 71912c42fc56b9d3d8e6f89d3d97b40491767343d86f78a95222db687f2ffb88d6479c4cd9e1d21b25d0524aae65e19f0b944dfe15bcfef4e02f1a79f48fcc4f
SSDEEP 98304:tFoG4QOye2FHAQfMArIeBTg07h27e09X6rS+BVcruRYk7VCXWxA:tMQh3fMArbdA
TLSH
T159870C427742D962D8540A7B8C9ADBC82371FD8AEE06630738C6772F2EB66C7DD03495
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommandLineW GetTempPathW DecodePointer RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection SetEvent GetCurrentThreadId GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExA LoadLibraryA LoadLibraryW LocalFree WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx SetStdHandle GetProcessHeap FreeEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapReAlloc GetFileType HeapSize FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA VirtualAlloc

user32

PostThreadMessageW

shell32

ShellExecuteW

ole32

CoCreateInstance CoReleaseServerProcess CoInitialize CoAddRefServerProcess CoUninitialize

Name

.text

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35.4MB

Virtual Size

35.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_b9c3319c0ee4d65409c9cfc4fe05a691_cobalt-strike_coinminer_glassworm_icedid_poet-rat_vidar

kernel32

user32

shell32

ole32

generic