2026-05-19_00cc220e6ca48489faf3ecb7e874af55_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-19_00cc220e6ca48489faf3ecb7e874af55_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 8.0MB
Sample260519-lsbfvady8p
SHA256 b02213a222f139f0f90389348d42a0859e1af5b370e2fa6320ea78c2049b08e3
MD5 00cc220e6ca48489faf3ecb7e874af55
SHA1 03e91194e3e5c9f047831683bbdc0a7e0c51d2e4
SHA512 26a29dc9893b7f647ba6e1c127f5dabcb761e08f08a1d7474087021171475227f3dd662618d796741ceac1159386ac88fce7538d7b1c5035dcf86a33c893d2ea
SSDEEP 196608:rYG7EFR4H/Wq+boIL1HBhBSrp1fIBxd2xUf3h:rZ7En4H/Wq0oIBdSlyjdr3h
TLSH
T1A186AF9661A400E4D0BAC1B98F6A9D03EBB174460730DBDB06E0E9A75FA7DF0AD7D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-19_00cc220e6ca48489faf3ecb7e874af55_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-05-19_00cc220e6ca48489faf3ecb7e874af55_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 8.0MB

2026-05-19_00cc220e6ca48489faf3ecb7e874af55_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 01796e41742c9f2ea3881f62d9a9c002
SHA256 b02213a222f139f0f90389348d42a0859e1af5b370e2fa6320ea78c2049b08e3
MD5 00cc220e6ca48489faf3ecb7e874af55
SHA1 03e91194e3e5c9f047831683bbdc0a7e0c51d2e4
SHA512 26a29dc9893b7f647ba6e1c127f5dabcb761e08f08a1d7474087021171475227f3dd662618d796741ceac1159386ac88fce7538d7b1c5035dcf86a33c893d2ea
SSDEEP 196608:rYG7EFR4H/Wq+boIL1HBhBSrp1fIBxd2xUf3h:rZ7En4H/Wq0oIBdSlyjdr3h
TLSH
T1A186AF9661A400E4D0BAC1B98F6A9D03EBB174460730DBDB06E0E9A75FA7DF0AD7D311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3762052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

userenv

GetUserProfileDirectoryA

psapi

GetModuleFileNameExW

winmm

timeBeginPeriod

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA

ws2_32

socket shutdown WSAStartup send select recv listen getsockopt ioctlsocket connect WSAGetLastError bind accept __WSAFDIsSet ntohs htons htonl getaddrinfo WSASetLastError closesocket freeaddrinfo setsockopt WSACleanup

kernel32

GetTimeFormatW GetDateFormatW FlsFree GetLastError MultiByteToWideChar SetThreadPriority LocalFree FormatMessageA GetCurrentProcess GetModuleHandleA GetProcAddress SetConsoleCtrlHandler GetStdHandle SetConsoleTextAttribute CreateDirectoryA FreeLibrary GetModuleFileNameA LoadLibraryA SetThreadExecutionState GetConsoleMode SetConsoleMode SetFileAttributesA CloseHandle ExitProcess ExpandEnvironmentStringsA ReadFile CreatePipe WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessW GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW SetLastError CompareStringW SystemTimeToFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetFileType WriteFile GetModuleHandleW GetModuleHandleExW ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentVariableW ReadConsoleA ReadConsoleW LoadLibraryW FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetCommandLineW GetCommandLineA LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapReAlloc HeapSize GetTimeZoneInformation SetEnvironmentVariableW RtlUnwind GetCurrentDirectoryW GetFullPathNameW SetStdHandle FindFirstFileExW IsValidCodePage GetACP GetModuleFileNameW FileTimeToSystemTime GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEndOfFile WriteConsoleW GetSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW CreateFileW QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo GetStringTypeW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread

user32

GetProcessWindowStation ExitWindowsEx GetUserObjectInformationW MessageBoxW

advapi32

CryptExportKey OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryValueExA AdjustTokenPrivileges LookupPrivilegeValueA DeregisterEventSource RegisterEventSourceW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW

bcrypt

BCryptGenRandom

crypt32

CertEnumCertificatesInStore CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71.9MB

Virtual Size

71.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-19_00cc220e6ca48489faf3ecb7e874af55_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

userenv

psapi

winmm

setupapi

ws2_32

kernel32

user32

advapi32

bcrypt

crypt32

generic