2026-11-11_728b7a24dbeab83ce47cf14849aea099_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

General

Target
2026-11-11_728b7a24dbeab83ce47cf14849aea099_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar
Size 35.4MB
Sample261113-l4chaah161
SHA256 151120bd43f8edf0840be51e1aa521d57c05f64c88b33a658004087de3736fda
MD5 728b7a24dbeab83ce47cf14849aea099
SHA1 840634b9a9bba649c0b3e0eaa65d9f2c04768dff
SHA512 c9c75caaf19e56e38f7b1fa9dc018e0953dfa52055cc042f597694c81a187e7efaa8fd52f587aa9120750d0de4b0d542826975dcce6dd074b49eab269688a941
SSDEEP 12288:u3/MEVBwe2zTyuXzQ2LHREmnVuzaUywtdmocUSTSKIzJjpPPPPPPPPP5fffffff1:uMEVOe2zTymzQ2zREmn41ywtdmRWeRk
TLSH
T172875B790B8B99CFE4D070584A90D89DEF9B627A0423C6149A77368FD2F06706DF3396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-11_728b7a24dbeab83ce47cf14849aea099_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-11-11_728b7a24dbeab83ce47cf14849aea099_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

.exe 35.4MB

2026-11-11_728b7a24dbeab83ce47cf14849aea099_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

IMPHASH 36ebd6ce55a108597c9e3f04a6edd060
SHA256 151120bd43f8edf0840be51e1aa521d57c05f64c88b33a658004087de3736fda
MD5 728b7a24dbeab83ce47cf14849aea099
SHA1 840634b9a9bba649c0b3e0eaa65d9f2c04768dff
SHA512 c9c75caaf19e56e38f7b1fa9dc018e0953dfa52055cc042f597694c81a187e7efaa8fd52f587aa9120750d0de4b0d542826975dcce6dd074b49eab269688a941
SSDEEP 12288:u3/MEVBwe2zTyuXzQ2LHREmnVuzaUywtdmocUSTSKIzJjpPPPPPPPPP5fffffff1:uMEVOe2zTymzQ2zREmn41ywtdmRWeRk
TLSH
T172875B790B8B99CFE4D070584A90D89DEF9B627A0423C6149A77368FD2F06706DF3396
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

76:46:c1:5d:94:4b:d2:70:81:6b:d9:34:ff:88:5a:65:eb:49:53:0e:c5:a9:47:0d:07:ce:44:12:46:5c:70:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Nov 6, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

PE Signature issue

Digest

0d:a9:9c:d7:ec:9d:1c:3b:c1:2d:a9:0b:43:f9:bc:fa:3b:af:ea:e8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

Chains

Nov 6, 2026

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=MM Apps\, Inc.,O=MM Apps\, Inc.,POSTALCODE=L8J 0H6,STREET=8 West Glen Avenue,L=Stoney Creek,ST=Ontario,C=CA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Minor OS version

0

Major OS version

6

Entry point

29388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

TerminateProcess WriteConsoleW HeapSize DeleteFileW GetProcAddress GetModuleHandleA IsValidLocale LoadLibraryA FreeLibrary PeekNamedPipe WaitForSingleObjectEx GetLastError SizeofResource FindResourceA FormatMessageW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetFullPathNameW GetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess RtlUnwind IsProcessorFeaturePresent CloseHandle InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateFileW GetFileType ExitProcess GetModuleHandleExW ReadFile GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapFree HeapAlloc FlushFileBuffers GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc SetStdHandle SetEndOfFile GetFileAttributesExW

user32

LoadStringA

Name

.text

Size

776KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

34.4MB

Virtual Size

34.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_728b7a24dbeab83ce47cf14849aea099_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar

PE Signature issue

PE Signature issue

kernel32

user32

generic