2026-06-08_2b83c64aef2e24cde8440a52d986dcc8_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-08_2b83c64aef2e24cde8440a52d986dcc8_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 4.2MB
Sample260608-pyks9aes71
SHA256 18ac60fcdbf3037b5255c2d42957f029e72f04d1da5284bb23507fb98cbfc3d6
MD5 2b83c64aef2e24cde8440a52d986dcc8
SHA1 86ae94297ac4f63bb98c04fb02c629dae72349f7
SHA512 4018936d3eef1aa0886a9f9df93bd579a5cd7341a30e1ab6b9c9c66b1f858c289f7d9ae6d75fe9e01215cafa9a62793e3594f941e2be3b70503b626c61e51226
SSDEEP 98304:T++dusi1oYlSiA7V261uGbFmQ7wRGpj3:C5si1oYlSiA7MMusFmMF9
TLSH
T189269D56665901FCD5B7D138C6CA5623E7B17C1603B18BCB02E4BA661F33AE26E3E341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-08_2b83c64aef2e24cde8440a52d986dcc8_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-06-08_2b83c64aef2e24cde8440a52d986dcc8_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.2MB

2026-06-08_2b83c64aef2e24cde8440a52d986dcc8_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 3f4b1e71518846c3ef9fb98f74128737
SHA256 18ac60fcdbf3037b5255c2d42957f029e72f04d1da5284bb23507fb98cbfc3d6
MD5 2b83c64aef2e24cde8440a52d986dcc8
SHA1 86ae94297ac4f63bb98c04fb02c629dae72349f7
SHA512 4018936d3eef1aa0886a9f9df93bd579a5cd7341a30e1ab6b9c9c66b1f858c289f7d9ae6d75fe9e01215cafa9a62793e3594f941e2be3b70503b626c61e51226
SSDEEP 98304:T++dusi1oYlSiA7V261uGbFmQ7wRGpj3:C5si1oYlSiA7MMusFmMF9
TLSH
T189269D56665901FCD5B7D138C6CA5623E7B17C1603B18BCB02E4BA661F33AE26E3E341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2379100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_win64\build\src\steamUI\gamestream\secure_desktop_capture\win64\Release\secure_desktop_capture.pdb

kernel32

GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalAlloc LocalFree MultiByteToWideChar SetLastError OutputDebugStringA WriteConsoleW FreeEnvironmentStringsW GetModuleHandleA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetFilePointerEx SetStdHandle LCMapStringW CompareStringW HeapValidate HeapSize SetConsoleCtrlHandler GetModuleHandleExW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe IsProcessorFeaturePresent UnhandledExceptionFilter RtlCaptureContext GetModuleFileNameW FreeLibrary GetCurrentProcessId GetEnvironmentStringsW Sleep WriteFile GetFullPathNameW FindFirstFileW FindClose CreateFileW Process32Next Process32First CreateToolhelp32Snapshot CreateFileMappingA UnmapViewOfFile MapViewOfFile OpenProcess GetCurrentProcess CreateEventA WaitForSingleObject ResetEvent SetEvent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader InitializeSListHead GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLastError CloseHandle LeaveCriticalSection ExitProcess EnterCriticalSection SetEndOfFile ReadFile GetFileSizeEx GetFileInformationByHandle GetCurrentDirectoryW FindNextFileW WideCharToMultiByte RtlVirtualUnwind InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetEnvironmentVariableW GetFileType GetModuleHandleW DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime IsDebuggerPresent TerminateProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW GlobalMemoryStatusEx VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameA GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation QueryPerformanceFrequency DuplicateHandle RaiseException TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread GetExitCodeThread SetUnhandledExceptionFilter LoadLibraryExA LoadLibraryExW LoadLibraryW DebugBreak GetProcessHeaps SetEnvironmentVariableW FindFirstFileExW FlushFileBuffers GetDriveTypeW RtlUnwind

user32

SetDlgItemInt GetDlgItem EndDialog SetDlgItemTextA CloseClipboard SetClipboardData EmptyClipboard GetDesktopWindow CloseDesktop GetDlgItemInt OpenClipboard OpenDesktopA GetWindowTextLengthA DialogBoxParamA GetWindowThreadProcessId EnumWindows GetShellWindow GetWindowRect IsWindowVisible ReleaseDC GetDC GetCursorInfo LoadCursorA GetCursorPos MessageBoxA GetSystemMetrics SendInput GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfA SetWindowPos

gdi32

GdiFlush SetBrushOrgEx CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC BitBlt

advapi32

RegSetValueExA RegisterEventSourceW DeregisterEventSource OpenProcessToken AddAccessAllowedAce RegDeleteTreeA ReportEventW RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid CreateWellKnownSid CopySid

shell32

CommandLineToArgvW

psapi

GetProcessMemoryInfo

bcrypt

BCryptGenRandom

ws2_32

WSASetLastError recv closesocket send WSACleanup WSAGetLastError

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

765KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-08_2b83c64aef2e24cde8440a52d986dcc8_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

psapi

bcrypt

ws2_32

generic