2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
Size 551KB
Sample260709-b7beaabv4l
SHA256 ee87bac2340f4d1ff529e43a75d497a0a6f0a3945c82f21a367de203c94275e3
MD5 e72bea7b6589b394d2ece8e16af4a724
SHA1 b92526fcc49e89dfefb61a4681cdf287a10e7e92
SHA512 a6731e898ee9a9fde072c6f806e15c525a709b348759be00e82125b088084504652cff5b8a4b1c436687175b05d70491e702e9ce6b5f4d5d7d042aae4a52c198
SSDEEP 6144:wGdKnwV1ekLXX/f4RT7yNGKURbJeQ2Kwh2/ivT+MdbWI1tfMQO2G9jERyn8NIiJ8:hKwmkuT7yNGKaFwwDMdbCtdYIXMo05
TLSH
T19AC45D6B569502ECE1B7C178CE464802FB76784A03A16DEF07D089B35E675E09F3BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

.exe 551KB

2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH c04fd35f2bd9afe0bf958d6046056790
SHA256 ee87bac2340f4d1ff529e43a75d497a0a6f0a3945c82f21a367de203c94275e3
MD5 e72bea7b6589b394d2ece8e16af4a724
SHA1 b92526fcc49e89dfefb61a4681cdf287a10e7e92
SHA512 a6731e898ee9a9fde072c6f806e15c525a709b348759be00e82125b088084504652cff5b8a4b1c436687175b05d70491e702e9ce6b5f4d5d7d042aae4a52c198
SSDEEP 6144:wGdKnwV1ekLXX/f4RT7yNGKURbJeQ2Kwh2/ivT+MdbWI1tfMQO2G9jERyn8NIiJ8:hKwmkuT7yNGKaFwwDMdbCtdYIXMo05
TLSH
T19AC45D6B569502ECE1B7C178CE464802FB76784A03A16DEF07D089B35E675E09F3BB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

281364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DefWindowProcA UnhookWindowsHookEx RegisterClassA GetForegroundWindow MapVirtualKeyA GetRawInputData GetWindowTextA SetWindowsHookExA CloseClipboard CreateWindowExA GetKeyboardState GetSystemMetrics CallNextHookEx RegisterRawInputDevices PostMessageA GetDC DestroyWindow DispatchMessageA GetMessageA ReleaseDC OpenClipboard GetCursorPos AddClipboardFormatListener PeekMessageA ToUnicode RemoveClipboardFormatListener GetClipboardData TranslateMessage

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoTaskMemFree CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

ws2_32

WSACleanup __WSAFDIsSet WSAIoctl closesocket select WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons inet_ntop getsockopt recv connect ntohs socket send getsockname WSAStartup inet_pton getaddrinfo

gdi32

CreateCompatibleBitmap DeleteDC GetDIBits CreateCompatibleDC SelectObject BitBlt DeleteObject

advapi32

AllocateAndInitializeSid RegEnumKeyExA RegDeleteValueA RegOpenKeyExA FreeSid OpenProcessToken RegSetValueExA SetEntriesInAclA AdjustTokenPrivileges RegCloseKey CredEnumerateW RegDeleteKeyA RegQueryValueExA SetNamedSecurityInfoA GetTokenInformation LookupPrivilegeValueA RegCreateKeyExA CredFree GetUserNameA CloseEventLog ClearEventLogA OpenEventLogA

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

shell32

ShellExecuteExA

mf

MFEnumDeviceSources

mfplat

MFCreateAttributes MFCreateMediaType MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

iphlpapi

NotifyAddrChange GetExtendedTcpTable GetAdaptersAddresses

dnsapi

DnsFree DnsQuery_A

kernel32

FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead LCMapStringW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleExW GetModuleFileNameW GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetFilePointerEx HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CreateFileW GetCPInfo GetStringTypeW GetModuleHandleW WriteConsoleW IsProcessorFeaturePresent GetTickCount64 ReadFile GetModuleFileNameA MoveFileA GetFileSizeEx Process32First SetHandleInformation FindFirstFileA VirtualProtect HeapFree AddDllDirectory GetCurrentProcess WriteFile RemoveDllDirectory VirtualAlloc TerminateProcess LoadLibraryExA SetFileTime InitializeProcThreadAttributeList FindNextFileA CreatePipe GetEnvironmentVariableA FindClose CreateMutexA WaitForSingleObject ReleaseMutex GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep CopyFileA GetLastError OpenMutexA UpdateProcThreadAttribute GetFileAttributesA MoveFileExA K32GetProcessMemoryInfo CreateFileA SetEvent FileTimeToSystemTime LoadLibraryA DeleteFileA Process32Next CloseHandle DeleteProcThreadAttributeList HeapAlloc GetLocalTime GetProcAddress GlobalLock LocalFree RemoveDirectoryA ExitProcess SetEnvironmentVariableA GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CreateProcessA GetDiskFreeSpaceExA CreateDirectoryA GetSystemTime CreateEventA GlobalUnlock GetFileTime IsDebuggerPresent GetComputerNameA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime

Name

.text

Size

407KB

Virtual Size

406KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

user32

ole32

oleaut32

ws2_32

gdi32

advapi32

crypt32

shell32

mf

mfplat

mfreadwrite

iphlpapi

dnsapi

kernel32

generic