2026-07-08_78ac69a1508d46cdf858ade75d641423_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_78ac69a1508d46cdf858ade75d641423_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom
Size 6.7MB
Sample260708-e4xpwsay7v
SHA256 f25d1ab25548f7393ea3cd05c3176eb2a9f852bbe7c168cbd3794114b40b4de8
MD5 78ac69a1508d46cdf858ade75d641423
SHA1 69c559fdc9999443e9bf76eccf5af64eb75d26a2
SHA512 13bf42b84b2de224620bcbb03fb948a749c63192266e5afe50746505786f75a107d4ef625a35386d581e3dc2e1410451357e656a69fc6132b7250eb3628833d4
SSDEEP 49152:JKH0oSg2ui++1XOWUTw2MmWai7w/OgOcUnVx/cUUdIBpmtBVpvy+OUkpVuXLPlYo:JUdSVx03pvDv
TLSH
T17466BF725206BCEAE2274E7480412702DC783C6B573492EBBACC46D77BA76D09D7E970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_78ac69a1508d46cdf858ade75d641423_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

File Explorer

2026-07-08_78ac69a1508d46cdf858ade75d641423_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

.exe 6.7MB

2026-07-08_78ac69a1508d46cdf858ade75d641423_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

IMPHASH 22ed9ab360c3f6215a0369ba46470418
SHA256 f25d1ab25548f7393ea3cd05c3176eb2a9f852bbe7c168cbd3794114b40b4de8
MD5 78ac69a1508d46cdf858ade75d641423
SHA1 69c559fdc9999443e9bf76eccf5af64eb75d26a2
SHA512 13bf42b84b2de224620bcbb03fb948a749c63192266e5afe50746505786f75a107d4ef625a35386d581e3dc2e1410451357e656a69fc6132b7250eb3628833d4
SSDEEP 49152:JKH0oSg2ui++1XOWUTw2MmWai7w/OgOcUnVx/cUUdIBpmtBVpvy+OUkpVuXLPlYo:JUdSVx03pvDv
TLSH
T17466BF725206BCEAE2274E7480412702DC783C6B573492EBBACC46D77BA76D09D7E970
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2087864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Daan\Documents\NL\Outro\Tueurs External V 2.9.3 (NEW)\built\Tueurs-External.pdb

kernel32

FreeLibrary QueryPerformanceCounter SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW GetProcessId Module32FirstW GetCurrentProcessId Module32NextW GetProcessHandleCount GetFileSizeEx CreateFileW SetEndOfFile WriteConsoleW HeapQueryInformation HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation CreatePipe GetExitCodeProcess WaitForSingleObject HeapReAlloc SetStdHandle DeleteFileW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect SetFilePointerEx HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetModuleFileNameW IsProcessorFeaturePresent GetProcAddress CreateProcessW DuplicateHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread TerminateProcess FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock GlobalLock GlobalFree GlobalAlloc AllocConsole VerifyVersionInfoW VerSetConditionMask CreateMutexA SetConsoleTextAttribute ExitProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot GetCurrentProcess GetCommandLineW GetStartupInfoW QueryFullProcessImageNameA OpenProcess FindClose GetCurrentThreadId GetTickCount ReadProcessMemory CloseHandle GetLastError GetTickCount64 GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection MultiByteToWideChar Sleep InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx LocalFree GetExitCodeThread ReleaseMutex GetStdHandle CreateDirectoryA WideCharToMultiByte ReadFile FormatMessageA RaiseException FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW GetSystemTimePreciseAsFileTime InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable WaitForSingleObjectEx RtlUnwind

user32

SendInput FindWindowW GetForegroundWindow GetAsyncKeyState mouse_event keybd_event ReleaseDC SetCursorPos SetForegroundWindow FindWindowA BringWindowToTop SetFocus AttachThreadInput ClientToScreen ShowWindow GetKeyboardState SendMessageW SetActiveWindow SetWindowPos GetDC GetWindowRect PostMessageW GetWindowThreadProcessId GetCursorPos EnumWindows GetWindowTextA IsWindowVisible SetProcessDPIAware GetKeyboardLayoutNameA SetClipboardData GetClipboardData EmptyClipboard MapVirtualKeyW ToUnicode GetSystemMetrics CloseClipboard GetWindowLongW DefWindowProcW MessageBoxW CreateWindowExW CallNextHookEx UnregisterClassW RegisterClassExW DispatchMessageW PeekMessageW SetWindowDisplayAffinity SetLayeredWindowAttributes RegisterRawInputDevices TranslateMessage LoadIconW SetWindowsHookExW SetWindowLongW PostQuitMessage UpdateWindow DestroyWindow UnregisterClassA GetKeyState GetMessageExtraInfo ScreenToClient GetCapture TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture OpenClipboard

gdi32

DeleteDC GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject

advapi32

CryptReleaseContext CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSetKeyParam CryptImportKey CryptGetHashParam

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitialize

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable

wininet

HttpQueryInfoA InternetOpenUrlA InternetOpenA InternetReadFile InternetCloseHandle

winmm

timeBeginPeriod PlaySoundA

ntdll

RtlPcToFileHeader

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_78ac69a1508d46cdf858ade75d641423_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

kernel32

user32

gdi32

advapi32

shell32

ole32

d3d11

d3dcompiler_47

dwmapi

winhttp

wininet

winmm

ntdll

imm32

generic