3f1d46f167acf8f4c7d16ae99446127cb70908bd57250673966406d6d87b50c2

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 04:50

Target
2026-04-18_f2de5180691a3cdbb2d4925f95dfdaef_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 11.1MB
Sample260418-fgplfagy9x
SHA256 3f1d46f167acf8f4c7d16ae99446127cb70908bd57250673966406d6d87b50c2
MD5 f2de5180691a3cdbb2d4925f95dfdaef
SHA1 6b9716c3e7caaec159d2a48c04394465addf2b37
SHA512 8107140aaa541713579cb969807b4dff664eee9aaed81a2bb357ff005223f1240148cb08dce75fe6db02ee91f91772d242b2d18334ce5f136eafb7db5dfffe18
SSDEEP 196608:VIfHWDcMtxuzrXN5SLVe03wG7gPUmV2VF/nDxFZahOm0FYqTUqO:WfHWDcMtxuzrXN5KcDS/nDRrFFj
TLSH
T10DC6025A629833ACD06BC17C8423E906E3F2755D03E4E6DF32D5BA903BA35E15A36B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

vmprotect

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral1/memory/4684-0-0x00007FF62DDF0000-0x00007FF62E914000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/4684-0-0x00007FF62DDF0000-0x00007FF62E914000-memory.dmp	vmprotect

C:\Users\Admin\AppData\Local\Temp\2026-04-18_f2de5180691a3cdbb2d4925f95dfdaef_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_f2de5180691a3cdbb2d4925f95dfdaef_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
PID:4684