2026-06-30_491b6fc1a1e0f4882bfff3a7ac651459_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_491b6fc1a1e0f4882bfff3a7ac651459_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 1.2MB
Sample260701-ftprzaey7m
SHA256 2d236b7d1f0bfabbdd6fd9a6f7a284e159d53bb1f6edcf90c45dc36a4e9e49bd
MD5 491b6fc1a1e0f4882bfff3a7ac651459
SHA1 829f959dca1a0fd781b57f0ba69dd0dff656e9ba
SHA512 03aa44efbb269740dff7efe8f2a76c329b7713139080a553c608c12bde0cabcef83e772707c2e0c54626fcfe93c874282f8af4a04e6ad12bc20c140a9a0687f0
SSDEEP 24576:OMQPaOK23gkKPYWdO/QWF/jCO0bRSEV00nlp:ePukKw/QiiVDn
TLSH
T13E45AE02729400F8D0F36275C927560FEB3AB897833196EF37AC49592F673C15ABAB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_491b6fc1a1e0f4882bfff3a7ac651459_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-06-30_491b6fc1a1e0f4882bfff3a7ac651459_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.2MB

2026-06-30_491b6fc1a1e0f4882bfff3a7ac651459_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH d0c01b39592efdfc4c325422b0daed67
SHA256 2d236b7d1f0bfabbdd6fd9a6f7a284e159d53bb1f6edcf90c45dc36a4e9e49bd
MD5 491b6fc1a1e0f4882bfff3a7ac651459
SHA1 829f959dca1a0fd781b57f0ba69dd0dff656e9ba
SHA512 03aa44efbb269740dff7efe8f2a76c329b7713139080a553c608c12bde0cabcef83e772707c2e0c54626fcfe93c874282f8af4a04e6ad12bc20c140a9a0687f0
SSDEEP 24576:OMQPaOK23gkKPYWdO/QWF/jCO0bRSEV00nlp:ePukKw/QiiVDn
TLSH
T13E45AE02729400F8D0F36275C927560FEB3AB897833196EF37AC49592F673C15ABAB15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

401880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PeekMessageA DispatchMessageA PostQuitMessage UnregisterClassA RegisterClassExA CreateWindowExA DestroyWindow DefWindowProcA GetClientRect ShowWindow OpenClipboard CloseClipboard LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos TranslateMessage GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData UpdateWindow EmptyClipboard SetClipboardData

d3d11

D3D11CreateDeviceAndSwapChain

shell32

ShellExecuteW

advapi32

RegDeleteValueW AdjustTokenPrivileges AllocateAndInitializeSid StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle RegGetValueW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW OpenProcessToken RegCreateKeyExW RegCloseKey LookupPrivilegeValueW RevertToSelf ImpersonateLoggedOnUser FreeSid DuplicateTokenEx CheckTokenMembership

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

iphlpapi

GetAdaptersAddresses

kernel32

LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID VirtualProtect SetFilePointerEx GetFileSizeEx WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe OutputDebugStringW HeapReAlloc FindClose FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile SetEndOfFile ExitProcess FindNextFileW CompareStringW CreateFileW GetFileAttributesW GetVolumeInformationW GetTempPathW CloseHandle EnumSystemLocalesW DeviceIoControl Sleep GetCurrentProcess OpenProcess IsProcessorFeaturePresent GlobalMemoryStatusEx GetModuleHandleA GetProcAddress GlobalAlloc GlobalUnlock GlobalLock GetFirmwareEnvironmentVariableW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA GetCurrentThreadId RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimePreciseAsFileTime WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead ReadFile FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetLastError ReadConsoleW WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle TerminateProcess RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree DeleteFileW DuplicateHandle CreateProcessW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

586KB

Virtual Size

586KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

621KB

Virtual Size

621KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_491b6fc1a1e0f4882bfff3a7ac651459_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

user32

d3d11

shell32

advapi32

ole32

oleaut32

iphlpapi

kernel32

imm32

d3dcompiler_47

generic