coffloader | 2026-06-04_d873deaa102c69ffeb9f8e31b3b5747c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_d873deaa102c69ffeb9f8e31b3b5747c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 2.1MB
Sample260604-2rb9ragt9y
SHA256 b3a60a0b7301da4d741d4a2d778720724bab6b34d288bba70e945f4f1a3cef0f
MD5 d873deaa102c69ffeb9f8e31b3b5747c
SHA1 9f094b3fb100ee3b211d3cb6a84015cc5b9f718d
SHA512 02f94896f7a0b0680b825b411f509adab028edb890b8fd1f5ba737f22333f8ad633e8fd4bfeca72e8b8b070c722ae0501da9e3a06ba3ea01d8ceb5aebd17b46b
SSDEEP 49152:IseEA7kO9WrsrIoplpD6aY+icF2QYFkfcA30k4g:QF++DBp4
TLSH
T1A1A5901762B800ECE277C1BCC9565A07D7B2F41613756BDB06908A962F27AE10FFE721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

loader coffloader

Malware Config

Signatures

Family: Coffloader
Coffloader is an open-source beacon loader written in C.
loader coffloader

Detects Coffloader 1 IoCs

resource	yara_rule
sample	family_coffloader

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_d873deaa102c69ffeb9f8e31b3b5747c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-06-04_d873deaa102c69ffeb9f8e31b3b5747c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 2.1MB

2026-06-04_d873deaa102c69ffeb9f8e31b3b5747c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 69923ded8432c16baf5f686ba2e99b7d
SHA256 b3a60a0b7301da4d741d4a2d778720724bab6b34d288bba70e945f4f1a3cef0f
MD5 d873deaa102c69ffeb9f8e31b3b5747c
SHA1 9f094b3fb100ee3b211d3cb6a84015cc5b9f718d
SHA512 02f94896f7a0b0680b825b411f509adab028edb890b8fd1f5ba737f22333f8ad633e8fd4bfeca72e8b8b070c722ae0501da9e3a06ba3ea01d8ceb5aebd17b46b
SSDEEP 49152:IseEA7kO9WrsrIoplpD6aY+icF2QYFkfcA30k4g:QF++DBp4
TLSH
T1A1A5901762B800ECE277C1BCC9565A07D7B2F41613756BDB06908A962F27AE10FFE721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Coffloader
Detects Windows executables referencing non-Windows User-Agents
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1560720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileSizeEx ReadFile RemoveDirectoryA SetFilePointerEx WriteFile GetTempPathA OutputDebugStringA CloseHandle GetLastError AddVectoredExceptionHandler RemoveVectoredExceptionHandler ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventW Sleep GetCurrentProcessId ExitProcess CreateThread GetCurrentThreadId ExitThread TerminateThread GetExitCodeThread ResumeThread GetThreadId GetTickCount GetTickCount64 CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryA lstrcatA lstrlenA MoveFileExA MultiByteToWideChar GetFileSize GetCurrentProcess GetExitCodeProcess GetSystemDirectoryA GetSystemDirectoryW VirtualAlloc DuplicateHandle DeviceIoControl TerminateProcess OpenProcess FreeLibrary GetModuleHandleW LoadLibraryExW HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect GetComputerNameA GlobalUnlock GlobalLock WideCharToMultiByte GetEnvironmentVariableA GetProcessId LocalFree CopyFileA FlushFileBuffers GetDiskFreeSpaceExA SetFilePointer QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GlobalMemoryStatusEx GetSystemInfo VirtualFree FileTimeToSystemTime GetThreadContext SetThreadContext MapViewOfFile UnmapViewOfFile OpenFileMappingA InitOnceExecuteOnce CreateRemoteThread OpenThread SuspendThread CreateProcessA VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx QueryFullProcessImageNameA Thread32First Thread32Next K32GetProcessMemoryInfo CreateDirectoryA GetFileAttributesExA ConnectNamedPipe CancelIo CreateEventA CreateNamedPipeA CreateFileW DeleteFileW FindFirstFileW FindNextFileW GetDriveTypeW GetLogicalDrives MoveFileExW SetHandleInformation CreatePipe DisconnectNamedPipe SetNamedPipeHandleState CancelSynchronousIo WaitNamedPipeA PeekNamedPipe HeapLock HeapUnlock HeapWalk CreateToolhelp32Snapshot CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetDriveTypeA SetFileAttributesA CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW GetNativeSystemInfo HeapReAlloc WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI RaiseException TryEnterCriticalSection DeleteCriticalSection WriteConsoleW ReadConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA VirtualQuery LoadLibraryExA TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetSystemTimePreciseAsFileTime WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree FreeLibraryAndExitThread GetModuleHandleExW SetStdHandle GetFileType IsProcessorFeaturePresent GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsA

mscoree

CLRCreateInstance

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

315KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

35KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.icfg

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_d873deaa102c69ffeb9f8e31b3b5747c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

wtsapi32

mscoree

generic