2026-05-28_1077de107aa90a8d880860e98c968869_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_1077de107aa90a8d880860e98c968869_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 2.4MB
Sample260528-e1sxjafs8n
SHA256 607396f1715fbe48d3f6c10b0dd5623f7374c58a6063946ac6ac710a54a04f79
MD5 1077de107aa90a8d880860e98c968869
SHA1 5ed7addc334489f5f70a0782ab25f2af794dc041
SHA512 5b4fb35583dc2c91f6da73375059e09149fb5b38b0891c4c10b93f2d7fdcecc83b7b06d6200426bf2a933e3196bbf8dd63b9ec8609519f60265e197e0697d2b8
SSDEEP 49152:LE/28/hQs/xeFSIJ4o+S3yE1dsuV1B4GAEjeQ9ryQ/lFTjN4:JxJ+ShAEPLm
TLSH
T19AB5BF26626801FCD0BBE1B8991A6907E7B67C0503B18BCF17A076962F777E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_1077de107aa90a8d880860e98c968869_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-05-28_1077de107aa90a8d880860e98c968869_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 2.4MB

2026-05-28_1077de107aa90a8d880860e98c968869_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 391e211af9116aa32911ff5627feb48d
SHA256 607396f1715fbe48d3f6c10b0dd5623f7374c58a6063946ac6ac710a54a04f79
MD5 1077de107aa90a8d880860e98c968869
SHA1 5ed7addc334489f5f70a0782ab25f2af794dc041
SHA512 5b4fb35583dc2c91f6da73375059e09149fb5b38b0891c4c10b93f2d7fdcecc83b7b06d6200426bf2a933e3196bbf8dd63b9ec8609519f60265e197e0697d2b8
SSDEEP 49152:LE/28/hQs/xeFSIJ4o+S3yE1dsuV1B4GAEjeQ9ryQ/lFTjN4:JxJ+ShAEPLm
TLSH
T19AB5BF26626801FCD0BBE1B8991A6907E7B67C0503B18BCF17A076962F777E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

989612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\JenkinsWorkspace\workspace\client_build_installer\client\build\working_directory\RelWithDebInfo\UbisoftGameLauncher64.pdb

discord-rpc.x64

Discord_Shutdown Discord_UpdatePresence Discord_Initialize

steam_api64

SteamAPI_RegisterCallback SteamAPI_UnregisterCallResult SteamAPI_UnregisterCallback SteamInternal_FindOrCreateUserInterface SteamInternal_CreateInterface SteamInternal_ContextInit SteamAPI_GetHSteamUser SteamAPI_RunCallbacks SteamAPI_Shutdown SteamInternal_SteamAPI_Init SteamAPI_RegisterCallResult

shell32

ShellExecuteExW CommandLineToArgvW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW

user32

DispatchMessageW TranslateMessage AllowSetForegroundWindow PostMessageW GetSystemMetrics RegisterRawInputDevices GetRawInputData GetAsyncKeyState DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PeekMessageW WaitMessage PostQuitMessage GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer

kernel32

GetConsoleOutputCP ReadConsoleW GetConsoleMode FlsAlloc GetFileType GetStdHandle LoadLibraryExW FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FlushFileBuffers SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA WriteConsoleW HeapSize SetEnvironmentVariableW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable InitializeSListHead GetCPInfo LCMapStringEx DecodePointer EncodePointer CloseHandle GetLastError CreateIoCompletionPort GetQueuedCompletionStatus OpenProcess IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentProcess TerminateProcess SearchPathW CreateFileW GetFullPathNameW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW WaitForSingleObject Sleep GetModuleHandleExA GetExitCodeProcess OpenThread ResumeThread CreateProcessA CreateProcessW GetProcessId GetVersionExW GetNativeSystemInfo IsWow64Process SetLastError GetExitCodeThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx ReadFile WriteFile DebugBreak HeapAlloc HeapFree GetProcessHeap GetOverlappedResult ResetEvent CreateEventW GetCurrentThreadId GetModuleFileNameA GetModuleHandleExW FormatMessageW GetFileInformationByHandleEx WideCharToMultiByte CreateThread FindClose FindNextFileW GetFileSizeEx SetEndOfFile SetFilePointerEx GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentProcessId ExitProcess LocalFree GetTimeZoneInformation GetLocaleInfoW GetTickCount IsDebuggerPresent OutputDebugStringA SetEvent WaitForMultipleObjectsEx RaiseException MultiByteToWideChar InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW FindFirstFileExW InitOnceBeginInitialize InitOnceComplete GetStringTypeW InitializeCriticalSectionEx

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

380KB

Virtual Size

380KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_1077de107aa90a8d880860e98c968869_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

discord-rpc.x64

steam_api64

shell32

advapi32

user32

kernel32

generic