2026-05-07_6f87d8197be2633334ee82fb17bbded8_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-07_6f87d8197be2633334ee82fb17bbded8_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar
Size 4.2MB
Sample260507-dltd3set91
SHA256 96f6486bc998d8f51966393a053e28f4dbd254d58d6f5e1cfb5ec187365dd263
MD5 6f87d8197be2633334ee82fb17bbded8
SHA1 b06e105fd8fab4b2a000d939b4be7903d73e8d20
SHA512 56acd6f0c3db8eecf02fa1ad82b61d068bb315d14af3eaef3fb68b5a159c575ae247b7c6cb084c4c5753b2c239042a1aa6dc453e6e628d814b25dcfaec2b363b
SSDEEP 49152:XY4ZEWGx3slfpX9W8603EG7yYC3iBfCRIDVWNJkMYsBCHPLvFDg+a9kFo52TC4Wj:XyM9lyXJJkEAaLo+y+MXGnxi21k
TLSH
T12D166C4772ED00D8D46AC175CA529A76E6B3BC513F7096CF1E84BAC81F33AE1493A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-07_6f87d8197be2633334ee82fb17bbded8_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-05-07_6f87d8197be2633334ee82fb17bbded8_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 4.2MB

2026-05-07_6f87d8197be2633334ee82fb17bbded8_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH d7d62d5cb3d0eef5d43c634a74b5fb19
SHA256 96f6486bc998d8f51966393a053e28f4dbd254d58d6f5e1cfb5ec187365dd263
MD5 6f87d8197be2633334ee82fb17bbded8
SHA1 b06e105fd8fab4b2a000d939b4be7903d73e8d20
SHA512 56acd6f0c3db8eecf02fa1ad82b61d068bb315d14af3eaef3fb68b5a159c575ae247b7c6cb084c4c5753b2c239042a1aa6dc453e6e628d814b25dcfaec2b363b
SSDEEP 49152:XY4ZEWGx3slfpX9W8603EG7yYC3iBfCRIDVWNJkMYsBCHPLvFDg+a9kFo52TC4Wj:XyM9lyXJJkEAaLo+y+MXGnxi21k
TLSH
T12D166C4772ED00D8D46AC175CA529A76E6B3BC513F7096CF1E84BAC81F33AE1493A712
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1705628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FlushFileBuffers SetStdHandle ReadConsoleW GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP EnumSystemLocalesW IsValidLocale GetStdHandle ExitProcess GetFileType GetDriveTypeW VirtualProtect GetSystemInfo MoveFileExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread SetEnvironmentVariableW RtlUnwindEx RtlPcToFileHeader ExpandEnvironmentStringsA GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent SetEndOfFile WriteConsoleW SystemTimeToFileTime SetFileTime LocalFileTimeToFileTime WaitNamedPipeW GetSystemTime GetStartupInfoW MoveFileW GetUserDefaultLCID GetFileTime IsBadReadPtr VerLanguageNameW GetProfileStringW GlobalFree FreeResource CreateThread GetExitCodeProcess WaitForMultipleObjects CreateEventW SetEvent PeekNamedPipe DuplicateHandle VirtualQuery SetFilePointer WritePrivateProfileStructW GetPrivateProfileStructW GetPrivateProfileStringW FileTimeToSystemTime CopyFileW FormatMessageW LocalFree GetTempPathW SetFileAttributesW GetTempFileNameW CreateDirectoryW GetModuleHandleA GetVersionExW GetFileSize TerminateThread FreeEnvironmentStringsW TerminateProcess CreatePipe ReadFile ExpandEnvironmentStringsW GetCurrentDirectoryW SetCurrentDirectoryW GetACP GlobalMemoryStatus CreateProcessW WriteFile GetThreadLocale GetTimeFormatW GetDateFormatW GetLocalTime CompareStringW VerifyVersionInfoW VerSetConditionMask OutputDebugStringW GetCurrentProcessId GetCurrentProcess SetUnhandledExceptionFilter GetComputerNameW GetVolumeInformationW GetFileAttributesW DeleteFileW GetSystemDefaultLangID WritePrivateProfileStringW GetPrivateProfileIntW lstrcpyW lstrcpynW lstrcmpiW lstrcmpW GlobalLock GlobalUnlock GlobalAlloc LoadLibraryW LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetTickCount Sleep CreateMutexW DecodePointer GetCommandLineW lstrlenW GetFullPathNameW FindNextFileW FindFirstFileW FindClose CreateFileW WideCharToMultiByte MultiByteToWideChar FindResourceW SizeofResource LockResource LoadResource FindResourceExW ResumeThread WaitForSingleObject CloseHandle MulDiv GetProcessHeap HeapSize HeapFree HeapReAlloc RaiseException HeapAlloc HeapDestroy GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection SetLastError GetLastError

user32

CloseClipboard OpenClipboard MonitorFromPoint IsWindowEnabled GetDlgCtrlID GetMessagePos FrameRect GetSysColorBrush SendDlgItemMessageW IsDlgButtonChecked CheckDlgButton mouse_event LoadIconW SetClassLongPtrW GetMenu SetDlgItemInt GetMenuItemID GetScrollInfo SetScrollInfo GetClassLongPtrW IsRectEmpty IntersectRect InflateRect GetWindowDC GetSubMenu DrawFocusRect TrackPopupMenu CheckMenuItem CreatePopupMenu DestroyCursor LoadBitmapW GetCursorPos SetCursor DrawIcon GetMenuStringW KillTimer SetTimer GetDlgItemInt SystemParametersInfoW DrawIconEx DestroyIcon OffsetRect SetDlgItemTextA wvsprintfW DeleteMenu GetClipboardData GetMenuItemCount GetScrollPos DrawEdge SetRectEmpty PtInRect RemoveMenu UpdateWindow GetCaretPos WinHelpW DrawFrameControl PostQuitMessage GetCapture SetWindowsHookExW UnhookWindowsHookEx wsprintfW SetClipboardData EmptyClipboard SendMessageW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow IsChild DestroyWindow ShowWindow MoveWindow SetWindowPos CreateDialogParamW SetFocus GetFocus EnableWindow SetActiveWindow EnableMenuItem EqualRect SetPropW InsertMenuW GetPropW GetDlgItemTextW AdjustWindowRectEx CheckRadioButton DeferWindowPos GetMenuState SetLayeredWindowAttributes LockWindowUpdate GetClipboardOwner SetCursorPos WindowFromPoint SetParent ModifyMenuW BringWindowToTop IsZoomed SetClipboardViewer ChangeClipboardChain SetMenu GetDoubleClickTime BeginDeferWindowPos CallNextHookEx GetWindowPlacement SetWindowPlacement IsIconic LoadStringA TranslateAcceleratorW TrackPopupMenuEx GetMenuItemInfoW SetMenuItemInfoW GetNextDlgTabItem SetMenuDefaultItem ScrollWindowEx SetScrollPos ShowScrollBar SetRect CheckMenuRadioItem AppendMenuW DestroyMenu IsMenu MessageBoxW GetActiveWindow DialogBoxParamW CopyRect DrawTextW GetKeyState IsWindowVisible LoadImageW GetClassNameW FindWindowW GetDesktopWindow EndDeferWindowPos CharLowerW InvertRect GetWindowThreadProcessId GetClientRect GetWindowRect MapWindowPoints GetWindowLongW SetWindowLongPtrW GetParent GetWindow LoadCursorW IsDialogMessageW MonitorFromWindow GetMonitorInfoW GetDC ReleaseDC PostMessageW EndDialog GetDlgItem SetDlgItemTextW MessageBeep LoadStringW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageTimeoutW DefWindowProcW CallWindowProcW CharNextW SetCapture ReleaseCapture LoadAcceleratorsW CreateAcceleratorTableW DestroyAcceleratorTable GetSystemMetrics LoadMenuW SetForegroundWindow BeginPaint EndPaint InvalidateRect InvalidateRgn RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW ClientToScreen ScreenToClient GetSysColor FillRect SetWindowLongW GetWindowLongPtrW

gdi32

CreateFontW SetStretchBltMode SetBrushOrgEx CreateBitmap CreateDCW CreatePatternBrush GetMapMode PatBlt ResetDCW SetMapMode SetRectRgn CloseEnhMetaFile CreateEnhMetaFileW DeleteEnhMetaFile GetEnhMetaFileHeader Polygon StartDocW EndDoc StartPage EndPage AbortDoc SetViewportExtEx SetWindowExtEx OffsetWindowOrgEx Polyline IntersectClipRect GetClipRgn RoundRect SetDCBrushColor GetBkColor GetTextColor SetPolyFillMode SelectPalette RealizePalette SetDIBColorTable CreatePalette CreateDIBSection SelectClipRgn Rectangle CreateRectRgn CreatePen GetTextExtentPoint32W GetTextMetricsW EnumFontFamiliesExW ExcludeClipRect CreateRectRgnIndirect CombineRgn MoveToEx StretchBlt SetDCPenColor LineTo GetPixel GetCurrentObject GetDIBColorTable SetWindowOrgEx SetViewportOrgEx LPtoDP ExtTextOutW TextOutW SetTextColor SetBkMode SetBkColor GetClipBox GetObjectW SelectObject SaveDC GetStockObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap BitBlt DPtoLP GetDeviceCaps DeleteObject PlayEnhMetaFile RestoreDC CreateFontIndirectW

winspool.drv

OpenPrinterW ClosePrinter GetPrinterW

comdlg32

GetSaveFileNameW GetOpenFileNameW ChooseColorW PrintDlgExW

advapi32

RegQueryValueW RegCreateKeyExW RegQueryValueExA RegOpenKeyExA RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegCreateKeyW RegOpenKeyW RegQueryValueExW CryptAcquireContextW CryptReleaseContext GetTokenInformation FreeSid AllocateAndInitializeSid OpenProcessToken RegSetValueW RegCloseKey CryptDecrypt CryptEncrypt CryptImportKey CryptSetKeyParam CryptDestroyKey

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW ExtractIconExW ord62 SHFileOperationW SHGetFileInfoW DragQueryFileW DragFinish DragAcceptFiles SHGetMalloc SHGetDesktopFolder ShellExecuteExW

ole32

CreateStreamOnHGlobal CoUninitialize CoGetClassObject CoCreateInstance CLSIDFromString CLSIDFromProgID StringFromGUID2 PropVariantClear OleLockRunning OleUninitialize OleInitialize CoInitialize CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc

oleaut32

VariantCopy SysAllocStringByteLen SysStringByteLen VarUdateFromDate VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayPutElement SafeArrayGetLBound SafeArrayGetUBound DispCallFunc VariantChangeType VariantCopyInd SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantClear VariantInit SysStringLen SysAllocStringLen SysAllocString SysFreeString

shlwapi

PathFileExistsW PathAppendW PathFindFileNameA PathFindFileNameW PathRemoveFileSpecW StrStrIW PathFindExtensionW PathAddExtensionW PathRemoveExtensionW StrCmpNW StrCmpNIW PathCombineW PathIsDirectoryW StrToIntW PathIsRelativeW

comctl32

InitCommonControlsEx ImageList_GetIcon ImageList_Create ImageList_Destroy ImageList_Add _TrackMouseEvent ImageList_LoadImageW CreateStatusWindowW ImageList_Draw ImageList_GetImageCount ImageList_DrawIndirect ImageList_ReplaceIcon

msimg32

GradientFill AlphaBlend TransparentBlt

uxtheme

IsThemeActive OpenThemeData SetWindowTheme CloseThemeData DrawThemeBackground GetThemeInt GetThemeBackgroundContentRect

gdiplus

GdipDrawImageRectI GdipCreateFromHDC GdipDrawImageRectRect GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipLoadImageFromFile GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipGetImageWidth GdiplusShutdown GdipAlloc

sqlite3

sqlite3_bind_text16 sqlite3_prepare_v2 sqlite3_open16 sqlite3_close sqlite3_reset sqlite3_finalize sqlite3_bind_null sqlite3_step sqlite3_exec sqlite3_bind_int

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

399KB

Virtual Size

398KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

83KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

424KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=11, id=259, version=26715,

count=199, id=261, version=26715,

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=199, version=41118,

count=19, id=260, version=28117,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=91, id=261, version=28117,

count=10, id=259, version=28117,

count=2, id=263, version=26715,

count=28, id=260, version=26715,

count=1, id=262, version=26715,

count=31, id=257, version=26715,

count=628, id=1, productName=Unmarked objects,

count=2, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=143, id=261, productName=VS2019 v16.4.0 build 28314, version=28314,

count=1, id=255, productName=VS2019 v16.4.0 build 28314, version=28314,

count=3, id=151,

count=1, id=258, productName=VS2019 v16.4.0 build 28314, version=28314,