castlerat | 2026-05-29_4002761f20ee6ce7611350bd160d4975_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_4002761f20ee6ce7611350bd160d4975_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 1.6MB
Sample260529-df8ltabw4t
SHA256 2e00b53eacca10b62b2075039f02d8e8201c5f9bfd14ddbf1491412328287c36
MD5 4002761f20ee6ce7611350bd160d4975
SHA1 187cb3d0602ac9c28e8656d815435f3bd201c90c
SHA512 d1306eb59d39ffc005acfbfd485722154d3afc11a81b2fbc2c525b601c90386ae3e3f51e5db95dd953971538819d55b77f8aac09dca04d4700c414d9723a90e7
SSDEEP 24576:vRSqTLt0Qghnw2jAexbIV6KpBZZtALXylNzQ/lXZi5Io0ZU:Uch5+ZU
TLSH
T1C475E647EBB651E4D8FAC1399652722BBC71385983349BD797808A474B62FF0E93E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan apt tag_150 castlerat

Malware Config

Signatures

Family: CastleRAT
CastleRAT is a trojan available in both Python and C variants.
trojan castlerat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects C variant of CastleRAT. 1 IoCs

trojan apt tag_150

resource	yara_rule
sample	family_castlerat_c

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_4002761f20ee6ce7611350bd160d4975_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-05-29_4002761f20ee6ce7611350bd160d4975_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.6MB

2026-05-29_4002761f20ee6ce7611350bd160d4975_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 02ba2b21ec91dff78db726e85fc0f9fb
SHA256 2e00b53eacca10b62b2075039f02d8e8201c5f9bfd14ddbf1491412328287c36
MD5 4002761f20ee6ce7611350bd160d4975
SHA1 187cb3d0602ac9c28e8656d815435f3bd201c90c
SHA512 d1306eb59d39ffc005acfbfd485722154d3afc11a81b2fbc2c525b601c90386ae3e3f51e5db95dd953971538819d55b77f8aac09dca04d4700c414d9723a90e7
SSDEEP 24576:vRSqTLt0Qghnw2jAexbIV6KpBZZtALXylNzQ/lXZi5Io0ZU:Uch5+ZU
TLSH
T1C475E647EBB651E4D8FAC1399652722BBC71385983349BD797808A474B62FF0E93E340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects C variant of CastleRAT.

trojan apt tag_150
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1253312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW GetFileSize ReadFile OpenProcess MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW PeekNamedPipe WideCharToMultiByte AllocConsole FreeConsole GetConsoleCP SetConsoleCP SetConsoleOutputCP GetConsoleWindow DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW SetLastError CopyFileW EnterCriticalSection LeaveCriticalSection HeapAlloc HeapReAlloc HeapFree GetProcessHeap CreateThread GetCurrentThreadId GlobalAlloc GlobalUnlock GlobalLock MulDiv GetLocalTime GetModuleHandleW GetExitCodeProcess SetEvent GetFileType GetFinalPathNameByHandleW DuplicateHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryFullProcessImageNameW GetCurrentDirectoryW GetModuleHandleExW FlushFileBuffers GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetCurrentProcessId LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetCurrentProcess HeapSize HeapValidate GetFileAttributesW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI TryEnterCriticalSection CreateMutexA SetCurrentDirectoryW HeapSetInformation GetTempFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx EncodePointer IsDebuggerPresent InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter LocalFree LocalAlloc LoadLibraryW GetProcAddress TerminateProcess CreateEventW WaitForDebugEvent ContinueDebugEvent GetCommandLineW CreateProcessW Sleep WaitForSingleObject CreatePipe CloseHandle WriteFile SetThreadExecutionState GetModuleFileNameW GetComputerNameExW ExitProcess CreateMutexW ExpandEnvironmentStringsW InitializeCriticalSection GetLastError GetTempPathA

user32

UpdateWindow DestroyWindow SendMessageW PrintWindow MoveWindow SetWindowPos IsWindowVisible OpenClipboard CloseClipboard SetClipboardData BeginPaint SendInput GetSystemMetrics CreateDesktopW GetWindowDC ReleaseDC GetWindowRect GetWindowLongW EnumChildWindows EnumWindows GetClassNameW ChangeDisplaySettingsExW SetDisplayConfig MonitorFromWindow GetMonitorInfoW SetThreadDesktop ToUnicodeEx GetKeyboardLayout GetMessageW TranslateMessage DispatchMessageW AttachThreadInput DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW GetClipboardData IsClipboardFormatAvailable AddClipboardFormatListener GetKeyState GetKeyboardState GetForegroundWindow GetWindowTextW GetWindowThreadProcessId LoadCursorW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx MessageBoxW OpenDesktopW CloseDesktop PostMessageW EndPaint InvalidateRect GetClientRect EnumDisplayMonitors ShowWindow SetProcessDpiAwarenessContext OpenInputDesktop IsWindow GetDC SetCursor FillRect EmptyClipboard

gdi32

SelectObject CreateSolidBrush GetPixel DeleteObject CreateCompatibleDC CreateDIBSection StretchBlt CreateCompatibleBitmap DeleteDC

advapi32

OpenProcessToken CreateWellKnownSid GetUserNameW RegGetValueW RegOpenKeyExW RegCloseKey RevertToSelf DuplicateTokenEx SetThreadToken GetTokenInformation

shell32

ShellExecuteW CommandLineToArgvW

ole32

CoTaskMemFree CoInitializeEx CoInitializeSecurity PropVariantClear CoCreateGuid CoInitialize CoCreateInstance CoUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocString VariantClear VariantInit

shlwapi

PathFileExistsW ord219 PathStripPathW

ntdll

NtQueryInformationProcess NtDuplicateObject NtClose DbgUiSetThreadDebugObject NtRemoveProcessDebug

rpcrt4

RpcRaiseException RpcStringFreeW RpcStringBindingComposeW NdrAsyncClientCall RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcBindingSetAuthInfoExW RpcBindingFree RpcBindingFromStringBindingW

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptGenRandom BCryptDestroyKey BCryptGenerateSymmetricKey BCryptEncrypt BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDecrypt

version

VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW

ncrypt

NCryptOpenStorageProvider NCryptOpenKey NCryptDecrypt NCryptFreeObject

gdiplus

GdipSaveImageToStream GdipAlloc GdipGetImageEncoders GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize GdipFree GdipCloneImage GdipDisposeImage GdipCreateBitmapFromHBITMAP

ws2_32

select recv freeaddrinfo getaddrinfo socket connect shutdown closesocket WSAStartup ioctlsocket getsockname send gethostbyname

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpConnect WinHttpQueryDataAvailable

mfplat

MFCreateAttributes MFGetStrideForBitmapInfoHeader MFCopyImage MFStartup MFCreateSourceResolver MFShutdown

mf

MFCreateMediaSession MFCreateTopologyNode MFCreateVideoRendererActivate MFEnumDeviceSources MFGetService MFCreateAudioRendererActivate MFCreateTopology

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_4002761f20ee6ce7611350bd160d4975_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

rpcrt4

crypt32

bcrypt

version

ncrypt

gdiplus

ws2_32

winhttp

mfplat

mf

mfreadwrite

generic