2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 5.1MB
Sample260717-spl7haet5p
SHA256 03c905483c0136e6786d4c2e7d3ae18535887583b939294d06dfb0ba028d3bdb
MD5 4cf0715f304cd4b14300cfa9bf64af3c
SHA1 3fc78381be816755476dffa0560695dd71d93516
SHA512 9dca95632e38afd5487e524ab14f03dbf23c204d01ccee305a34d8153e9bdf944610d67655fdee3f900bb68462b5702e3a1079649f0b29e22ba820a8a0350bc3
SSDEEP 98304:geSvki8Be0b7cb15v5vRmFc9FwNH3600GQhMtzzEsNaCdhI4h:geSci8Be0b7cb1DJmb93nQW1aj
TLSH
T1C446C0A767F12ADDC266D0F8C112B53FE763B4282729B1E782D526A0DB13DD46738B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 5.1MB

2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 3c3b3a46e94823aca5d2ed49362a6c22
SHA256 03c905483c0136e6786d4c2e7d3ae18535887583b939294d06dfb0ba028d3bdb
MD5 4cf0715f304cd4b14300cfa9bf64af3c
SHA1 3fc78381be816755476dffa0560695dd71d93516
SHA512 9dca95632e38afd5487e524ab14f03dbf23c204d01ccee305a34d8153e9bdf944610d67655fdee3f900bb68462b5702e3a1079649f0b29e22ba820a8a0350bc3
SSDEEP 98304:geSvki8Be0b7cb15v5vRmFc9FwNH3600GQhMtzzEsNaCdhI4h:geSci8Be0b7cb1DJmb93nQW1aj
TLSH
T1C446C0A767F12ADDC266D0F8C112B53FE763B4282729B1E782D526A0DB13DD46738B01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1502668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpGetDefaultProxyConfiguration

kernel32

VirtualQuery LocalFree WideCharToMultiByte OutputDebugStringA GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte VerSetConditionMask FreeLibrary ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW LoadLibraryW SleepEx WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetSystemInfo DeviceIoControl GetCurrentThreadId GetTempPathW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetEndOfFile GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode DeleteFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue AddVectoredExceptionHandler TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW DecodePointer HeapReAlloc GlobalFree MultiByteToWideChar HeapSize UnmapViewOfFile MapViewOfFile InitializeCriticalSectionEx CreatePipe GetCurrentProcess AddDllDirectory SetDefaultDllDirectories SetHandleInformation GetWindowsDirectoryA GetFileAttributesA GetExitCodeProcess FlushFileBuffers VirtualQueryEx GetTickCount QueryPerformanceCounter VirtualFreeEx GlobalFindAtomA GetModuleHandleW CreateProcessW GetProcessHeap GetCurrentProcessId SetEnvironmentVariableA DeleteCriticalSection GetFileSize MoveFileExW VirtualAllocEx GetProcAddress VirtualProtectEx HeapAlloc CreateThread CloseHandle DeleteFileA LoadLibraryA GetSystemDirectoryA CreateFileA GetLastError GetTickCount64 Sleep GetModuleHandleA GetSystemDirectoryW GetFileAttributesW RtlUnwind WaitForSingleObject GetEnvironmentVariableA SetErrorMode InitializeCriticalSection LeaveCriticalSection RtlAddFunctionTable GetModuleFileNameW TerminateProcess GetSystemTimeAsFileTime WakeAllConditionVariable LCMapStringEx EncodePointer SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetExitCodeThread FormatMessageA VirtualAlloc WriteFile SetDllDirectoryW CreateFileMappingW CreateProcessA QueryFullProcessImageNameW CreateFileW VirtualFree EnterCriticalSection SetLastError HeapDestroy HeapFree VirtualProtect GetFileSizeEx GlobalGetAtomNameA GetModuleFileNameA ReadFile WriteConsoleW TlsGetValue

user32

RegisterRawInputDevices SetLayeredWindowAttributes TranslateMessage LoadCursorW CreateWindowExA PostQuitMessage LoadIconW GetForegroundWindow GetRawInputData DefWindowProcA RegisterClassA MessageBoxA UpdateWindow EnumWindows SetWindowTextA GetWindowTextA DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics SendMessageW DestroyWindow GetMessageW EndPaint GetKeyState GetMessageExtraInfo BeginPaint PeekMessageW IsWindow RegisterClassExW ScreenToClient CreateWindowExW SetWindowLongPtrW SetWindowPos IsWindowVisible GetWindowRect GetWindow DefWindowProcW GetWindowThreadProcessId GetWindowLongW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture GetCursorPos

gdi32

CreateFontA DeleteObject

advapi32

RegCreateKeyW OpenServiceA StartServiceA OpenSCManagerA CloseServiceHandle CreateServiceA GetTokenInformation AddAccessAllowedAce GetLengthSid SetSecurityInfo InitializeAcl OpenProcessToken IsValidSid RegDeleteKeyA ConvertSidToStringSidW CopySid CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey RegCreateKeyExA CryptImportKey CryptEncrypt SystemFunction036 RegOpenKeyW RegDeleteTreeW RegSetKeyValueW RegCloseKey

shell32

ShellExecuteA ShellExecuteW

crypt32

CertAddCertificateContextToStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup bind connect getsockopt getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen recvfrom sendto ioctlsocket gethostname inet_pton ntohl getaddrinfo inet_ntop getpeername freeaddrinfo WSAWaitForMultipleEvents

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptGenRandom

ntdll

NtLoadDriver NtQuerySystemInformation RtlAdjustPrivilege RtlInitUnicodeString NtUnloadDriver

winmm

timeEndPeriod timeBeginPeriod

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

164KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

winhttp

kernel32

user32

gdi32

advapi32

shell32

crypt32

ws2_32

bcrypt

ntdll

winmm

d3d11

dwmapi

shlwapi

psapi

wintrust

dnsapi

userenv

imm32

d3dcompiler_47

generic