2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 8.2MB
Sample260720-rw2ebsfs9t
SHA256 d2c4160850e892180ecbe23da63cecac741301d55a3892b9453c57a757c59d43
MD5 5cfa25c719178568382dcc36c6356a0b
SHA1 2cfe45da2ee7282053dc97ec1d904a64114c868a
SHA512 3301b8891fb86446329cd915d75965d93fd297c6d381fe11ab35561f0c541d9cfc287e918c52bc795843b1ccc0abf0bb354fd3a8e99d18993c9dafe41c792bcd
SSDEEP 49152:osAdExHcZoQDhpjqLnV/4gXrugGVSd8Yq35yivlrhuqs0vscZBeLqVZA9kUVRchO:xkfmnV/3UIgv6XzTrlP7wRGpj3
TLSH
T187967D1EB66D40E9C1BFD2788957A40AEE727895033596DB67E04E190F23EF09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 8.2MB

2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH e8879d9d011431cce17c347b76358f0b
SHA256 d2c4160850e892180ecbe23da63cecac741301d55a3892b9453c57a757c59d43
MD5 5cfa25c719178568382dcc36c6356a0b
SHA1 2cfe45da2ee7282053dc97ec1d904a64114c868a
SHA512 3301b8891fb86446329cd915d75965d93fd297c6d381fe11ab35561f0c541d9cfc287e918c52bc795843b1ccc0abf0bb354fd3a8e99d18993c9dafe41c792bcd
SSDEEP 49152:osAdExHcZoQDhpjqLnV/4gXrugGVSd8Yq35yivlrhuqs0vscZBeLqVZA9kUVRchO:xkfmnV/3UIgv6XzTrlP7wRGpj3
TLSH
T187967D1EB66D40E9C1BFD2788957A40AEE727895033596DB67E04E190F23EF09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3969056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\46b11e3b0e9c76c4\BUILDS\Release\x64\CCleaner.pdb

shell32

Shell_NotifyIconW SHEmptyRecycleBinW SHQueryRecycleBinW SHAddToRecentDocs ShellExecuteW ord155 SHGetKnownFolderIDList SHQueryUserNotificationState ShellExecuteExW SHGetKnownFolderPath SHChangeNotify CommandLineToArgvW ord165

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

normaliz

IdnToAscii

wininet

InternetCrackUrlW

userenv

ExpandEnvironmentStringsForUserW

ntdll

RtlDllShutdownInProgress NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation RtlUnwindEx RtlPcToFileHeader NtQueryInformationWorkerFactory NtSetInformationThread RtlCaptureContext NtDeleteKey NtQueryKey NtOpenKey RtlUnwind RtlNtStatusToDosError NtOpenFile RtlInitUnicodeString VerSetConditionMask

shlwapi

PathAppendW PathBuildRootW PathGetDriveNumberW PathIsUNCW PathIsRelativeW PathIsDirectoryW PathMatchSpecW PathFileExistsA AssocQueryStringW PathFindFileNameA PathFileExistsW SHCreateStreamOnFileEx UrlUnescapeW

bcrypt

BCryptSetProperty BCryptDeriveKey BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptSecretAgreement BCryptCloseAlgorithmProvider BCryptImportKeyPair BCryptGenerateSymmetricKey BCryptEncrypt BCryptExportKey

rpcrt4

RpcMgmtEpEltInqNextW I_RpcBindingInqLocalClientPID RpcRevertToSelf RpcImpersonateClient RpcServerUnregisterIfEx RpcServerRegisterIf2 RpcObjectSetType RpcServerUseProtseqEpW RpcEpRegisterW RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall UuidToStringW RpcMgmtEpEltInqBegin Ndr64AsyncClientCall NdrServerCallAll NdrServerCall2 NdrAsyncServerCall Ndr64AsyncServerCallAll RpcStringBindingParseW UuidFromStringW RpcIfInqId RpcAsyncInitializeHandle NdrClientCall3 RpcBindingFree RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW UuidCreate RpcAsyncCancelCall RpcMgmtEpEltInqDone

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

kernel32

K32GetProcessImageFileNameW lstrlenW WideCharToMultiByte CreateFileW GetFileSizeEx ReadFile OutputDebugStringA GetModuleFileNameA CreateSemaphoreExW HeapFree ReleaseSemaphore GetModuleHandleExW WaitForSingleObject ReleaseMutex WaitForSingleObjectEx OpenSemaphoreW HeapAlloc CreateMutexExW GetProcessHeap DebugBreak LocalFree LocalAlloc InitializeCriticalSectionEx DeleteCriticalSection DecodePointer FindResourceW LoadResource SizeofResource LockResource GetWindowsDirectoryW Sleep GetCurrentProcess K32EnumProcesses K32GetModuleBaseNameW GetModuleFileNameW ProcessIdToSessionId QueryFullProcessImageNameW GetTickCount64 VerifyVersionInfoW HeapDestroy HeapReAlloc HeapSize TerminateProcess GetCurrentThread GetSystemInfo GetSystemDirectoryW GetVolumePathNameW CreateToolhelp32Snapshot Module32FirstW GetLogicalDrives RemoveDirectoryW FreeLibrary LoadLibraryW SetErrorMode GetPrivateProfileStringW SetFileInformationByHandle QueryDosDeviceW GetTempPathW GetDriveTypeW GetVolumeInformationW GetFileInformationByHandleEx CompareStringW LeaveCriticalSection EnterCriticalSection GetFileAttributesW SetFileAttributesW GetDiskFreeSpaceW GetDiskFreeSpaceExW GetFileSize DeviceIoControl SetFilePointer SetEndOfFile FlushFileBuffers FindFirstFileW FindNextFileW FindClose GetFileTime SetFileTime DeleteFileW MoveFileExW CreateDirectoryW GetFileInformationByHandle WriteFile InitializeCriticalSection SetEvent ResetEvent GetOverlappedResult GetSystemTime QueryPerformanceCounter GlobalMemoryStatusEx GetSystemDefaultLangID GetSystemDefaultLCID GetOEMCP GetACP GetTimeZoneInformation GetStartupInfoW AreFileApisANSI TryEnterCriticalSection HeapCreate GetFullPathNameW LockFile GetFullPathNameA UnlockFileEx GetVersionExW UnmapViewOfFile DuplicateHandle HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA GetVersionExA MultiByteToWideChar RaiseException HeapCompact UnlockFile CreateFileMappingA LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile CreateDirectoryA FindFirstFileA FindNextFileA GetFileAttributesExA RemoveDirectoryA SetFilePointerEx GetLocalTime MoveFileA ReplaceFileA GetProcessId GetEnvironmentVariableW SetEnvironmentVariableW CreateThread GetTickCount GetExitCodeProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute CheckRemoteDebuggerPresent GetCurrentThreadId FlushInstructionCache SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery GetPriorityClass OpenThread GetThreadPriority GetThreadTimes K32GetProcessMemoryInfo Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort ReadProcessMemory TlsFree TlsAlloc TlsSetValue TlsGetValue GetNativeSystemInfo GetSystemTimes GetProcessTimes PostQueuedCompletionStatus GetQueuedCompletionStatus CancelIoEx VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive CompareFileTime QueryUnbiasedInterruptTime UnregisterWaitEx ReadDirectoryChangesW GetLocaleInfoW LoadLibraryExW ResumeThread TerminateThread SetThreadPriority InitializeCriticalSectionAndSpinCount QueryThreadCycleTime FileTimeToSystemTime DeleteProcThreadAttributeList GetThreadId ExpandEnvironmentStringsW GetShortPathNameW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW GetDateFormatW GetTimeFormatW GetExitCodeThread GetCurrentDirectoryW FindFirstFileExW CopyFileW GetProcAddress FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose K32GetMappedFileNameW SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks CancelIo SetNamedPipeHandleState WaitForMultipleObjectsEx WaitNamedPipeW WriteFileEx ReadFileEx GetModuleHandleW SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx TryAcquireSRWLockExclusive SwitchToThread ReleaseSRWLockShared AcquireSRWLockShared GetStringTypeW WakeConditionVariable InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork IsProcessorFeaturePresent EncodePointer OpenProcess CreateMutexW CreateEventW CloseHandle WaitForMultipleObjects GetCurrentProcessId SetLastError GetLastError IsDebuggerPresent CreateProcessW LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter InitializeSListHead InterlockedPushEntrySList FormatMessageW VirtualProtect ExitThread FreeLibraryAndExitThread GetStdHandle ExitProcess GetFileType OutputDebugStringW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapQueryInformation WriteConsoleW RegisterWaitForSingleObject DeleteFileA FindFirstVolumeW

user32

GetDialogBaseUnits GetSysColor GetProcessWindowStation GetOpenClipboardWindow GetMessageTime GetMessagePos GetInputState GetFocus GetClipboardViewer GetClipboardOwner GetCapture GetActiveWindow GetCursorPos GetCaretPos CloseClipboard EmptyClipboard GetDesktopWindow OpenClipboard FindWindowExW GetClientRect SetWindowLongW GetKeyboardType GetTitleBarInfo GetDoubleClickTime GetCaretBlinkTime PeekMessageW IsHungAppWindow SendMessageCallbackW GetGUIThreadInfo LoadStringW GetWindowLongW LoadCursorW MonitorFromRect EnableWindow IsWindow EnumWindows MonitorFromPoint GetDC GetSystemMetrics DispatchMessageW TranslateMessage GetMessageW MessageBoxA GetKeyboardLayout SystemParametersInfoW SetActiveWindow ShowWindow SendMessageTimeoutW InvalidateRect SetClassLongPtrW GetClassInfoExW AdjustWindowRect GetForegroundWindow RegisterWindowMessageW CreateWindowExW GetWindowPlacement GetWindowRect MonitorFromWindow SetWindowPos GetMonitorInfoW MoveWindow SetFocus GetWindowThreadProcessId GetWindow SetTimer GetLastInputInfo IsWindowVisible PostQuitMessage SendMessageW FindWindowW SetWindowTextW PostMessageW DestroyWindow DestroyMenu TrackPopupMenu SetForegroundWindow SetMenuDefaultItem InsertMenuItemW CreatePopupMenu DefWindowProcW GetWindowLongPtrW SetWindowLongPtrW RegisterClassExW KillTimer LoadIconW

gdi32

DeleteObject GetDeviceCaps CreateSolidBrush

advapi32

RegLoadKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCreateKeyExW EventUnregister EventRegister EventWriteTransfer QueryServiceStatus RevertToSelf DuplicateTokenEx ConvertStringSecurityDescriptorToSecurityDescriptorW ClearEventLogW OpenEventLogW CloseEventLog InitializeAcl AddAce ConvertStringSidToSidW GetSidSubAuthorityCount GetSidSubAuthority RegDeleteValueW RegQueryMultipleValuesW RegNotifyChangeKeyValue RegDeleteKeyExW RegEnumKeyW CryptAcquireContextW CryptGenRandom CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership ImpersonateSelf ImpersonateLoggedOnUser RegQueryValueExW RegEnumValueW RegQueryInfoKeyW RegOpenCurrentUser RegSetValueExW RegSetKeyValueW RegDeleteKeyValueW RegCloseKey OpenProcessToken EqualSid GetTokenInformation AllocateAndInitializeSid FreeSid RegGetValueW GetUserNameW ConvertSidToStringSidW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx ControlService StartServiceW OpenThreadToken DuplicateToken LookupAccountSidW RegDeleteKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteTreeW GetLengthSid

ole32

CoInitializeEx CoUninitialize CoTaskMemAlloc IIDFromString CLSIDFromString CoCreateGuid CoTaskMemFree CoCreateInstance

oleaut32

SysFreeString VariantClear VariantInit SysAllocString

comctl32

ord345

powrprof

CallNtPowerInformation

fltlib

FilterLoad FilterSendMessage FilterGetMessage FilterReplyMessage FilterConnectCommunicationPort

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

547KB

Virtual Size

590KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

359KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_5cfa25c719178568382dcc36c6356a0b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

shell32

version

normaliz

wininet

userenv

ntdll

shlwapi

bcrypt

rpcrt4

wtsapi32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

powrprof

fltlib

generic