2026-07-19_265f3267e9bf21a7a3632585de7012cc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_265f3267e9bf21a7a3632585de7012cc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.9MB
Sample260719-3bb5gsas41
SHA256 dac9053eb657672b98b559a65d0c3e6c3973e695b7873da4fbbf948e0263320f
MD5 265f3267e9bf21a7a3632585de7012cc
SHA1 874b069c03c61c0bb86489997b262d55e7215952
SHA512 855118014a19e3afcaf2866ab80400aabcdbcdcab96a4cc71a8fd258024a102a1e968ae4c4cd0785de9819beb9f30d9d09081c8587f7647734b820c6856da7e3
SSDEEP 49152:ruXGfh+DIJ3wv7oAQ4ki0ixM0H7wfdyTfD5TAlNtNtMtU+pfTy1dyGJCXN0b5nto:rI7v7ThN0mo
TLSH
T15F167D1FBA1D00E9C1FEE17D8A86550BEA713896433597CB66E08E590F13AF19E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-19_265f3267e9bf21a7a3632585de7012cc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.9MB

2026-07-19_265f3267e9bf21a7a3632585de7012cc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH a9aedfb02b8695999e1df2886e023f19
SHA256 dac9053eb657672b98b559a65d0c3e6c3973e695b7873da4fbbf948e0263320f
MD5 265f3267e9bf21a7a3632585de7012cc
SHA1 874b069c03c61c0bb86489997b262d55e7215952
SHA512 855118014a19e3afcaf2866ab80400aabcdbcdcab96a4cc71a8fd258024a102a1e968ae4c4cd0785de9819beb9f30d9d09081c8587f7647734b820c6856da7e3
SSDEEP 49152:ruXGfh+DIJ3wv7oAQ4ki0ixM0H7wfdyTfD5TAlNtNtMtU+pfTy1dyGJCXN0b5nto:rI7v7ThN0mo
TLSH
T15F167D1FBA1D00E9C1FEE17D8A86550BEA713896433597CB66E08E590F13AF19E7E700
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

96:9a:dd:36:96:72:dc:c8:7b:15:8c:bc:6b:ad:6c:08:45:93:d3:ae:15:85:95:7d:61:6f:04:df:29:4e:75:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Jun 12, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

705616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x64\avDump.pdb

rpcrt4

RpcStringBindingComposeW UuidCreate UuidFromStringW UuidToStringW RpcMgmtEpEltInqDone RpcIfInqId RpcMgmtEpEltInqBegin RpcMgmtEpEltInqNextW RpcServerUnregisterIfEx RpcServerRegisterIf2 RpcObjectSetType RpcEpRegisterW RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcAsyncCancelCall Ndr64AsyncClientCall NdrAsyncServerCall Ndr64AsyncServerCallAll RpcStringBindingParseW NdrClientCall3 NdrServerCall2 NdrServerCallAll RpcServerUnregisterIf RpcServerRegisterIfEx RpcServerUseProtseqEpW RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcStringFreeW RpcBindingFromStringBindingW RpcBindingFree

bcrypt

BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptDestroySecret

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

shell32

ord165 SHGetKnownFolderPath

ntdll

RtlNtStatusToDosError RtlGetLastNtStatus NtClose NtSetInformationThread NtQueryKey NtDeleteKey RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind VerSetConditionMask NtSystemDebugControl RtlDllShutdownInProgress NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlPcToFileHeader RtlUnwindEx NtOpenKey

kernel32

FormatMessageW GetCurrentThreadId GetModuleHandleExW GetModuleFileNameA DebugBreak GetOverlappedResult DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx GetTickCount64 SetLastError OutputDebugStringW IsDebuggerPresent Sleep SetFilePointerEx UnlockFileEx LockFileEx GetFileSizeEx VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce GetCurrentProcessId AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile QueryUnbiasedInterruptTime TerminateThread ResumeThread ResetEvent GetTickCount SetThreadPriority GetCurrentProcess LocalFree RaiseException GetThreadTimes InitializeCriticalSectionAndSpinCount QueryThreadCycleTime LocalAlloc InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessTimes ReadProcessMemory GetThreadId CreateProcessW TerminateProcess GetExitCodeProcess GetPriorityClass ProcessIdToSessionId K32GetProcessMemoryInfo InitializeCriticalSectionEx LoadLibraryW CompareFileTime QueryFullProcessImageNameW FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime TlsAlloc TlsGetValue TlsSetValue FreeLibrary LoadLibraryExW CompareStringW GetSystemInfo ExpandEnvironmentStringsW GetFileAttributesW GetSystemDirectoryW SetErrorMode VirtualProtect HeapReAlloc GlobalMemoryStatusEx GetEnvironmentVariableW GetThreadPriority GetExitCodeThread TlsFree SetFilePointer SetFileAttributesW SetEndOfFile MoveFileExW GetWindowsDirectoryW DuplicateHandle FindFirstFileW FindClose CreateDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose VirtualQuery GetSystemTimes GetNativeSystemInfo GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetProcessHandleCount GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetCurrentThread HeapFree GetProcessHeap HeapAlloc GetModuleFileNameW VerifyVersionInfoW SetConsoleCtrlHandler SetDllDirectoryW GetProcAddress GetModuleHandleW WaitForSingleObject GetProcessId GetNamedPipeServerProcessId GetFileTime CreateFileW MultiByteToWideChar ContinueDebugEvent DebugActiveProcessStop GetFileAttributesExW GetSystemTimeAsFileTime OpenThread DebugBreakProcess SetEvent WaitForDebugEvent DebugSetProcessKillOnExit DebugActiveProcess WideCharToMultiByte VirtualQueryEx GetThreadContext K32GetProcessImageFileNameW K32GetModuleBaseNameW K32EnumProcessModules OpenProcess WaitForMultipleObjects GetLastError CreateEventW CloseHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FreeEnvironmentStringsW SetStdHandle HeapSize HeapQueryInformation WriteConsoleW UnregisterWaitEx ReadDirectoryChangesW WaitForThreadpoolWaitCallbacks WaitForSingleObjectEx FormatMessageA GetStringTypeW AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive GetLocaleInfoEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork RegisterWaitForSingleObject SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent WakeConditionVariable InitOnceBeginInitialize InitOnceComplete FlsFree FlsSetValue K32EnumProcesses RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter FlushInstructionCache CheckRemoteDebuggerPresent CreateThread SetEnvironmentVariableW EncodePointer DecodePointer LCMapStringEx K32GetPerformanceInfo LoadLibraryExA FlsGetValue FlsAlloc GetFileType ExitProcess GetCommandLineW GetCommandLineA GetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait

user32

RegisterWindowMessageW LoadStringW SendMessageW PeekMessageW IsHungAppWindow SendMessageCallbackW SetWindowLongPtrW PostMessageW GetSystemMetrics RegisterClassExW GetClassInfoExW GetGUIThreadInfo

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfig2W ChangeServiceConfig2W StartServiceCtrlDispatcherW OpenSCManagerW CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegDeleteKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW FreeSid RegOpenKeyExW CheckTokenMembership DuplicateToken StartServiceW AllocateAndInitializeSid ConvertSecurityDescriptorToStringSecurityDescriptorW GetFileSecurityW ImpersonateSelf AdjustTokenPrivileges LookupPrivilegeValueW RevertToSelf EqualSid OpenProcessToken GetTokenInformation EventUnregister EventRegister EventWriteTransfer RegCloseKey QueryServiceStatus OpenThreadToken CloseServiceHandle ControlService ChangeServiceConfigW CreateServiceW DeleteService OpenServiceW SetThreadToken

ole32

CoTaskMemFree CoCreateGuid

powrprof

CallNtPowerInformation

fltlib

FilterSendMessage FilterGetMessage FilterReplyMessage FilterLoad FilterConnectCommunicationPort

shlwapi

PathAppendW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

870KB

Virtual Size

870KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

431KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_265f3267e9bf21a7a3632585de7012cc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

rpcrt4

bcrypt

wtsapi32

shell32

ntdll

kernel32

user32

advapi32

ole32

powrprof

fltlib

shlwapi

version

generic