Extracted

• • Target
    2026-02-18_81e6521386a2f38016c49f9a21e6bcac_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
  • Size 15.6MB
  • SHA256 dfd7028e04c45410369c8dbce657fa0b31dd8885bb5632078f1daa10c1f33521
  • MD5 81e6521386a2f38016c49f9a21e6bcac
  • SHA1 2a248c1e9a1cca11d65db9b6e63bf7d1452088c2
  • SHA512 077a967576f8a588788c3d7f2d1d2965feb5988540bb251c86ff700244292e14b3196ab36f76af4863d5db3d6ea220d3c4275714db6b9c2fa76ccb15f8da33af
  • SSDEEP 393216:/GH85vzQ9c5hlEa+/GQL+BFEXph/PNMtN3ZW43DTJo++:l5vzAEhf+/GQkFetMtN3r3yZ
  • TLSH
    T133F63387B3614CE9F797423BE8D68A79CE7034624F14EA5B0F6422D80BDB3D85E36641
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerthemidatrojanbackdoorwarmcookie

  • Warmcookie family

    warmcookie

  • Warmcookie, Badspace

    Warmcookie aka Badspace is a backdoor written in C++.

    backdoorwarmcookie

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2