2026-07-06_3de5228c717f4bfdb25620f8e2f8c9d0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_3de5228c717f4bfdb25620f8e2f8c9d0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm
Size 7.6MB
Sample260706-1ta9sshv7j
SHA256 5d1fc0d21eb64d5dba1b26b48676da004326283c34787397718ded9b2a160a88
MD5 3de5228c717f4bfdb25620f8e2f8c9d0
SHA1 58069d5b0cd51b681709ab4a5bc4932333b2459b
SHA512 dc741304335cad2a118eb59a038b8d32773c66eca51444eb51bc92566be6b1ad43134a6a583e58480869a48f91bcae655c1840f5e0ab74ff9a6252599f0a659e
SSDEEP 98304:6WQtZ/K0tGOFWVRuLftCTdWQtZ/K0tGOFWVRuLftCTd:6WyZ/K0ttYVAATdWyZ/K0ttYVAATd
TLSH
T16D864913F58500E9D05ED179CF669232EB3278890BF2B5EF369056E12E27AE07B38754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_3de5228c717f4bfdb25620f8e2f8c9d0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm

File Explorer

2026-07-06_3de5228c717f4bfdb25620f8e2f8c9d0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm

.exe 7.6MB

2026-07-06_3de5228c717f4bfdb25620f8e2f8c9d0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm

IMPHASH c949ad80dfe3ad62903784edee1e4a0a
SHA256 5d1fc0d21eb64d5dba1b26b48676da004326283c34787397718ded9b2a160a88
MD5 3de5228c717f4bfdb25620f8e2f8c9d0
SHA1 58069d5b0cd51b681709ab4a5bc4932333b2459b
SHA512 dc741304335cad2a118eb59a038b8d32773c66eca51444eb51bc92566be6b1ad43134a6a583e58480869a48f91bcae655c1840f5e0ab74ff9a6252599f0a659e
SSDEEP 98304:6WQtZ/K0tGOFWVRuLftCTdWQtZ/K0tGOFWVRuLftCTd:6WyZ/K0ttYVAATdWyZ/K0ttYVAATd
TLSH
T16D864913F58500E9D05ED179CF669232EB3278890BF2B5EF369056E12E27AE07B38754
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1906864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

setup.exe.pdb

advapi32

AdjustTokenPrivileges BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW ChangeServiceConfigW CloseServiceHandle ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW CreateServiceW CreateWellKnownSid DeleteService DeregisterEventSource DuplicateToken EventRegister EventUnregister EventWrite GetLengthSid GetNamedSecurityInfoW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle GetUserNameW ImpersonateNamedPipeClient InitializeSid IsValidSid LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceConfigW RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW RegEnumValueA RegEnumValueW RegLoadKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW RegUnLoadKeyW RegisterEventSourceA RegisterTraceGuidsW ReportEventA RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo SystemFunction036 TraceEvent UnregisterTraceGuids

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW ord680 SHChangeNotify SHGetFolderPathW SHGetKnownFolderPath SHOpenWithDialog SHQueryUserNotificationState ShellExecuteExW ShellExecuteW

user32

AllowSetForegroundWindow CallNextHookEx CharUpperW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EqualRect GetActiveWindow GetForegroundWindow GetMessageW GetMonitorInfoW GetQueueStatus GetSystemMetrics GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowThreadProcessId IntersectRect KillTimer LoadIconW MessageBoxW MonitorFromRect MonitorFromWindow MoveWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterClassW SendMessageW SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowsHookExW TranslateMessage UnhookWindowsHookEx UnregisterClassW

ws2_32

ntohl

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject AttachConsole CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeConsole FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleDisplayMode GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetPriorityClass GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPreferredUILanguages GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenMutexW OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime QueueUserAPC RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessShutdownParameters SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SuspendThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory lstrcmpiW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpGetProxyForUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpWriteData

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken

netapi32

NetApiBufferFree NetGetJoinInformation

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

propsys

InitPropVariantFromCLSID

shlwapi

ord437 PathMatchSpecW UrlCanonicalizeW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

urlmon

CreateURLMonikerEx

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

ncrypt

NCryptCreatePersistedKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptGetProperty NCryptImportKey NCryptIsAlgSupported NCryptOpenStorageProvider NCryptSignHash

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

627KB

Virtual Size

626KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

136B

Characteristics

Name

.tls

Size

512B

Virtual Size

313B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

70B

Characteristics

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

489KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_3de5228c717f4bfdb25620f8e2f8c9d0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar_xworm

advapi32

dbghelp

shell32

user32

ws2_32

kernel32

winhttp

ole32

wtsapi32

netapi32

version

userenv

propsys

shlwapi

winmm

urlmon

oleaut32

ncrypt

generic