2026-07-03_24ad9d9019ed635586d38f75f3d029a0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nedsym_njrat_remcos_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_24ad9d9019ed635586d38f75f3d029a0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nedsym_njrat_remcos_satacom_stealc_vidar
Size 46.1MB
Sample260703-rt744af19q
SHA256 d0fc7a557115b15ccbfb83d0d604ef8c8f6d5f6c1411be772a2af09460445dc8
MD5 24ad9d9019ed635586d38f75f3d029a0
SHA1 48bebfb7de5470bc1a4e4a858b7a214db7b13be6
SHA512 ed9101aa16819d318c921f159d54ee88d5dd17f9c9948f0c50cf3772898292256590cbbe1cc55882d3018fe18ad1758bc8ea035460a49a5e8de592883a9e00e8
SSDEEP 786432:3lr35ZipJw6E2Hc8dtUmfyiI9LnGK2Vyg:3p35WJ7E2XnzI9LnDZ
TLSH
T17FB77CC2D1E6D0E0C3D976343041721AEB63F4D94E3C92AA2FF14F0626FEB9155DAA19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_24ad9d9019ed635586d38f75f3d029a0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nedsym_njrat_remcos_satacom_stealc_vidar

File Explorer

2026-07-03_24ad9d9019ed635586d38f75f3d029a0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nedsym_njrat_remcos_satacom_stealc_vidar

.exe 46.1MB

2026-07-03_24ad9d9019ed635586d38f75f3d029a0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nedsym_njrat_remcos_satacom_stealc_vidar

IMPHASH 711b3543ce3a48e6d9c8249febb838c1
SHA256 d0fc7a557115b15ccbfb83d0d604ef8c8f6d5f6c1411be772a2af09460445dc8
MD5 24ad9d9019ed635586d38f75f3d029a0
SHA1 48bebfb7de5470bc1a4e4a858b7a214db7b13be6
SHA512 ed9101aa16819d318c921f159d54ee88d5dd17f9c9948f0c50cf3772898292256590cbbe1cc55882d3018fe18ad1758bc8ea035460a49a5e8de592883a9e00e8
SSDEEP 786432:3lr35ZipJw6E2Hc8dtUmfyiI9LnGK2Vyg:3p35WJ7E2XnzI9LnDZ
TLSH
T17FB77CC2D1E6D0E0C3D976343041721AEB63F4D94E3C92AA2FF14F0626FEB9155DAA19
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37298902

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

ws2_32

getsockopt setsockopt getpeername bind WSASetLastError getsockname ntohs select __WSAFDIsSet inet_pton WSAGetLastError accept shutdown WSACleanup WSAStartup socket send recv htons htonl connect closesocket inet_ntop WSAIoctl listen getnameinfo gethostname sendto recvfrom ntohl freeaddrinfo getaddrinfo ioctlsocket

wldap32

ord30 ord200 ord301 ord27 ord22 ord41 ord50 ord45 ord35 ord26 ord60 ord211 ord33 ord32 ord46 ord79 ord143

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA CertAddCertificateContextToStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

winhttp

WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSetOption WinHttpSendRequest WinHttpGetDefaultProxyConfiguration WinHttpOpen WinHttpCrackUrl WinHttpReceiveResponse

kernel32

GetModuleHandleA GetProcAddress LoadLibraryA CloseHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlAddFunctionTable Sleep GetCurrentProcessId GetTickCount VirtualAlloc LoadLibraryExA CreateFileW DeviceIoControl GetCurrentThreadId VirtualFree GetStdHandle SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess SetConsoleTextAttribute GetTempPathW GetModuleFileNameW GetLastError GetExitCodeProcess VirtualProtectEx VirtualFreeEx GetCommandLineA GetCommandLineW CreateDirectoryA CreateFileA DeleteFileA DeleteFileW GetFileAttributesA ReadFile SetFileAttributesW WriteFile GetTempPathA GetTempFileNameA IsDebuggerPresent OutputDebugStringA CheckRemoteDebuggerPresent DecodePointer SetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection ExitProcess CreateThread OpenThread ResumeThread CreateProcessA CreateProcessW GetProcessId GetThreadId GetThreadContext GetProcessMitigationPolicy SetThreadContext OpenProcess GetSystemInfo GetTickCount64 GetWindowsDirectoryW VirtualProtect VirtualQuery FreeLibrary ReadProcessMemory WriteProcessMemory GetModuleFileNameA GetModuleHandleW LoadLibraryW LocalFree QueryFullProcessImageNameW GlobalFindAtomA SetConsoleTitleA Thread32First Thread32Next K32EnumProcessModules K32GetModuleFileNameExW K32GetModuleInformation FormatMessageA EnterCriticalSection LeaveCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA WaitForSingleObjectEx ExpandEnvironmentStringsA GetFileType PeekNamedPipe WaitForMultipleObjects GetFileSizeEx GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW FormatMessageW GetSystemTimeAsFileTime RtlVirtualUnwind SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber FindClose FindFirstFileW FindNextFileW GetSystemTime SystemTimeToFileTime GetSystemDirectoryW GetModuleHandleExA AddDllDirectory SetDefaultDllDirectories SetDllDirectoryW InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW GetStartupInfoW QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetFileInformationByHandleEx EncodePointer InitializeSListHead GetStringTypeW GetLocaleInfoEx GetExitCodeThread TryAcquireSRWLockExclusive GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle LCMapStringEx CompareStringEx GetCPInfo OutputDebugStringW RaiseException RtlUnwindEx RtlPcToFileHeader LoadLibraryExW ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime SetFilePointerEx SetConsoleCtrlHandler DuplicateHandle GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers WaitForSingleObject GetTimeZoneInformation SetStdHandle CreatePipe IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetFileTime AreFileApisANSI SetEnvironmentVariableW SetEndOfFile WriteConsoleW VirtualAllocEx RtlUnwind WakeAllConditionVariable GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

SetLayeredWindowAttributes GetSystemMetrics RegisterClassExA UnregisterClassA CreateWindowExA MoveWindow GetWindowRect PostQuitMessage DefWindowProcA WaitForInputIdle SetProcessDPIAware MonitorFromWindow MessageBoxA GetProcessWindowStation GetUserObjectInformationW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorW MessageBoxW

gdi32

DeleteObject CreateSolidBrush GetDeviceCaps CreateRectRgn

advapi32

ReportEventW RegOpenKeyW RegSetKeyValueW RegDeleteTreeW OpenProcessToken RegCloseKey CopySid SystemFunction036 ConvertSidToStringSidA SetSecurityInfo RegDeleteKeyA InitializeAcl AddAccessAllowedAce CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptAcquireContextA FreeSid CheckTokenMembership AllocateAndInitializeSid ConvertSidToStringSidW OpenServiceA OpenSCManagerW OpenSCManagerA EnumServicesStatusExW ControlService CloseServiceHandle CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCreateKeyExA GetUserNameA GetLengthSid RegisterEventSourceW DeregisterEventSource IsValidSid GetTokenInformation RegCreateKeyW

shell32

CommandLineToArgvW ShellExecuteA ShellExecuteW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmIsCompositionEnabled DwmGetColorizationColor

ntdll

RtlCaptureContext NtUnloadDriver RtlInitUnicodeString RtlAdjustPrivilege NtQuerySystemInformation NtLoadDriver RtlLookupFunctionEntry NtTerminateProcess

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateShaderResourceViewFromFileW

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

urlmon

URLDownloadToFileA URLDownloadToFileW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

bcrypt

BCryptGenRandom

dnsapi

DnsQuery_A DnsFree

Name

.text

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.1MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cn"

Size

14.8MB

Virtual Size

14.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.6):

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Q!u

Size

15.2MB

Virtual Size

15.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_24ad9d9019ed635586d38f75f3d029a0_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nedsym_njrat_remcos_satacom_stealc_vidar

d3d11

d3dcompiler_43

ws2_32

wldap32

crypt32

winhttp

kernel32

user32

gdi32

advapi32

shell32

imm32

dwmapi

ntdll

d3dx11_43

shlwapi

userenv

urlmon

psapi

wintrust

bcrypt

dnsapi

generic