2026-06-27_f424240c3f01da0f55aec5cedf90f32d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_f424240c3f01da0f55aec5cedf90f32d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.6MB
Sample260629-bqq4eabt4m
SHA256 25d01c02254af0d68c48f6251f9461833f8aaa88efc49639e8288b519f0678b7
MD5 f424240c3f01da0f55aec5cedf90f32d
SHA1 c4c1f7a1c8a26780cf6876662427fc91914c133e
SHA512 118ea7b158fe9d88ffa22f52ca62fa55bdf89e38d51b5f2d70210236adb7b4b73e51adff61db5201340f6e7b638ec095a5887a4dee7d0908932879bb10c2629b
SSDEEP 98304:hn/9ui68Hcz+DyQQH3EQraqUFeHfcIMFPD:FC8Hcz+9QHXRIOEIM
TLSH
T11926AD82F29180A4C4669538CD52EBA7D372BC095F2157DB32D0BF1A2F732C25E7A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_f424240c3f01da0f55aec5cedf90f32d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-06-27_f424240c3f01da0f55aec5cedf90f32d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.6MB

2026-06-27_f424240c3f01da0f55aec5cedf90f32d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH f81379d879663f1b0f1edde96f991a67
SHA256 25d01c02254af0d68c48f6251f9461833f8aaa88efc49639e8288b519f0678b7
MD5 f424240c3f01da0f55aec5cedf90f32d
SHA1 c4c1f7a1c8a26780cf6876662427fc91914c133e
SHA512 118ea7b158fe9d88ffa22f52ca62fa55bdf89e38d51b5f2d70210236adb7b4b73e51adff61db5201340f6e7b638ec095a5887a4dee7d0908932879bb10c2629b
SSDEEP 98304:hn/9ui68Hcz+DyQQH3EQraqUFeHfcIMFPD:FC8Hcz+9QHXRIOEIM
TLSH
T11926AD82F29180A4C4669538CD52EBA7D372BC095F2157DB32D0BF1A2F732C25E7A791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1475392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sohai\source\repos\dx11ware2\bin\x64\Release\dx11ware2.pdb

kernel32

AllocConsole K32QueryWorkingSetEx VirtualQueryEx Module32FirstW Module32NextW QueryPerformanceFrequency GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc CloseHandle Process32FirstW Process32NextW WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetEndOfFile SetStdHandle CreatePipe CreateToolhelp32Snapshot MoveFileW FlushFileBuffers HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc ReadConsoleW GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW DeleteFileW GetConsoleMode DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetConsoleOutputCP WriteFile SetFilePointerEx FreeLibraryAndExitThread ExitThread CreateThread AddVectoredExceptionHandler RtlCaptureStackBackTrace GetCurrentProcess QueryPerformanceCounter RemoveVectoredExceptionHandler WaitForSingleObject VerSetConditionMask GetTimeZoneInformation CreateProcessW DuplicateHandle GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree OpenProcess SetLastError GetTickCount GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar GetCurrentThreadId GetConsoleWindow GetCurrentProcessId LoadLibraryW GetModuleHandleA FormatMessageA FreeLibrary GetProcAddress LoadLibraryA GetLastError GetExitCodeProcess TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitOnceBeginInitialize InitOnceComplete TryAcquireSRWLockExclusive GetFileInformationByHandleEx GetModuleFileNameA MoveFileExW AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW InitializeCriticalSectionEx Sleep SleepEx GetSystemDirectoryA GetEnvironmentVariableA MoveFileExA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects WaitForSingleObjectEx FormatMessageW VerifyVersionInfoA CreateFileA GetFileSizeEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead GetStringTypeW LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW

user32

CreateWindowExW SendInput GetWindowRect DefWindowProcW GetWindowThreadProcessId SetWindowLongPtrW GetCursorPos IsWindowUnicode UnregisterClassW RegisterClassExW GetWindowTextA MoveWindow EnumWindows PostQuitMessage GetDesktopWindow UpdateWindow SetForegroundWindow mouse_event GetAsyncKeyState ShowWindow ScreenToClient FindWindowA GetForegroundWindow GetKeyNameTextA MapVirtualKeyW GetClientRect MapWindowPoints SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos ReleaseCapture GetSystemMetrics SetCursor SetCapture LoadCursorW TrackMouseEvent ClientToScreen GetCapture GetMessageExtraInfo GetKeyState GetWindowDisplayAffinity TranslateMessage SetWindowDisplayAffinity PeekMessageW DispatchMessageW

shell32

ShellExecuteW

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundW waveOutSetVolume

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

crypt32

CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore PFXImportCertStore CertCloseStore CertOpenStore CertFreeCertificateChain CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertEnumCertificatesInStore

ws2_32

htons WSAEventSelect gethostname freeaddrinfo getaddrinfo ioctlsocket htonl sendto accept closesocket recv send socket inet_pton WSAGetLastError __WSAFDIsSet select WSASetLastError bind connect getpeername getsockname getsockopt WSAEnumNetworkEvents ntohs setsockopt WSAIoctl WSAStartup WSACleanup ntohl listen WSACloseEvent WSACreateEvent recvfrom

wldap32

ord45 ord50 ord41 ord60 ord211 ord46 ord26 ord27 ord32 ord33 ord22 ord35 ord79 ord30 ord200 ord301 ord143

dbghelp

SymInitialize SymFromAddr

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

521KB

Virtual Size

521KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

148KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_f424240c3f01da0f55aec5cedf90f32d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

shell32

d3d11

winmm

imm32

d3dcompiler_47

dwmapi

d3dx11_43

crypt32

ws2_32

wldap32

dbghelp

advapi32

generic