2026-07-23_d98e574d4033a61dc4bea3af6c78672b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_d98e574d4033a61dc4bea3af6c78672b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 8.4MB
Sample260723-yexs5stygs
SHA256 5d2840187568865cf2be394221b8898ba8dbbbc738fe42b70bfe2617a1137b07
MD5 d98e574d4033a61dc4bea3af6c78672b
SHA1 ad7336fbecca29bce274862521540465daf5801d
SHA512 ee8928313fb653f2646d9bf00afa4fd2413e0c25b2cf5232a2fb03593bf33000bcef94b780c6e0ab72a059f974b9dec36a24a6eba553ec1027ec2309ed12faac
SSDEEP 98304:laEX05h497K5al3tM4kzlbOtLDs4jBeT007kxh+k:4y05hgK5al3tM4kBbOtLDhjB9076h+k
TLSH
T17196B05BA7E800ECD8B6C17CC9568503EBB2BC1157319BDF1A64566A0F73AE05E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_d98e574d4033a61dc4bea3af6c78672b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-23_d98e574d4033a61dc4bea3af6c78672b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 8.4MB

2026-07-23_d98e574d4033a61dc4bea3af6c78672b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ca54ceb76285f7ce801cc90d7b95df1a
SHA256 5d2840187568865cf2be394221b8898ba8dbbbc738fe42b70bfe2617a1137b07
MD5 d98e574d4033a61dc4bea3af6c78672b
SHA1 ad7336fbecca29bce274862521540465daf5801d
SHA512 ee8928313fb653f2646d9bf00afa4fd2413e0c25b2cf5232a2fb03593bf33000bcef94b780c6e0ab72a059f974b9dec36a24a6eba553ec1027ec2309ed12faac
SSDEEP 98304:laEX05h497K5al3tM4kzlbOtLDs4jBeT007kxh+k:4y05hgK5al3tM4kBbOtLDhjB9076h+k
TLSH
T17196B05BA7E800ECD8B6C17CC9568503EBB2BC1157319BDF1A64566A0F73AE05E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4323896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\JENKINS\workspace\A_MBAM3_UPDATEREXE\bin\x64\Release\mbupdatr.pdb

crypt32

CertGetCertificateChain CertGetIssuerCertificateFromStore CertCreateCertificateContext CertCompareCertificateName CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertFreeCertificateChain CryptDecodeObject CryptDecodeObjectEx CryptMsgGetParam CertGetNameStringW CertFindCertificateInStore CryptQueryObject CryptMsgClose CertFreeCertificateContext CertDuplicateCertificateContext CertAddEncodedCertificateToStore CertOpenStore CryptStringToBinaryA CertCloseStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertOpenSystemStoreW CryptProtectData CryptUnprotectData

iphlpapi

GetAdaptersInfo

kernel32

CreateWaitableTimerW SetWaitableTimer GetLongPathNameW DuplicateHandle GetSystemFirmwareTable DeviceIoControl OpenThread SetThreadPriority SetFileInformationByHandle GlobalAlloc GlobalFree GetLocalTime GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation SetFileTime FindNextFileW FindClose lstrcmpA GetFileSize GetStdHandle FindFirstFileW GetFileAttributesW GetModuleHandleA GetFileAttributesExW OutputDebugStringW QueryPerformanceFrequency QueryPerformanceCounter ExpandEnvironmentStringsW GetDriveTypeW GetLogicalDrives GetSystemWindowsDirectoryW GetCurrentDirectoryW GetVersionExA GetHandleInformation CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeCriticalSection InitOnceExecuteOnce SetFileCompletionNotificationModes GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount ResetEvent ReleaseMutex CreateMutexW GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetEnvironmentVariableW VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA LoadLibraryA FormatMessageA ReleaseSemaphore CreateSemaphoreA GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetFileAttributesW FlushFileBuffers GetFullPathNameW GetFileInformationByHandle VirtualQueryEx GetCurrentThread QueryDosDeviceW GetLogicalDriveStringsW Module32FirstW Process32NextW Process32FirstW CreateToolhelp32Snapshot SetLastError GetNativeSystemInfo CopyFileW GetSystemInfo VerifyVersionInfoW VerSetConditionMask GetVersionExW LockResource LoadResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte ProcessIdToSessionId GetCurrentProcess MoveFileW CreateThread GetProcessId GetProcessHeap FormatMessageW HeapSize HeapReAlloc HeapFree HeapAlloc GetCurrentThreadId LocalAlloc GetTickCount CallNamedPipeW DebugBreak CreateRemoteThread OpenEventW GetNamedPipeServerProcessId WriteFile WaitForMultipleObjects CreateEventW FreeLibrary SetEvent LoadLibraryW GetSystemDirectoryW GetProcAddress MoveFileExW GetExitCodeProcess ResumeThread CreateProcessW OpenFileMappingW GetProcessTimes SwitchToThread UnmapViewOfFile TerminateProcess OpenProcess SetEndOfFile SetFilePointer MapViewOfFile CreateFileMappingW CreateDirectoryW RemoveDirectoryW CreateNamedPipeW GetCurrentProcessId GetTickCount64 GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW PeekNamedPipe ReadFile GetModuleFileNameW WaitForSingleObject DeleteFileW CreateFileW DecodePointer GetModuleHandleW LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx LocalFree DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList GetLastError CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA SetConsoleCtrlHandler GetConsoleOutputCP RtlUnwind SetFilePointerEx SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx RaiseException IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable InitializeSListHead GetCPInfo LCMapStringEx EncodePointer FindFirstFileExW GetStringTypeW IsWow64Process GetFileSizeEx Sleep DeleteCriticalSection CloseHandle

user32

CloseDesktop OpenInputDesktop MessageBoxW wsprintfW GetProcessWindowStation GetUserObjectInformationW CharUpperW CloseWindowStation OpenWindowStationW SetProcessWindowStation

advapi32

CryptAcquireContextW OpenServiceW ControlService CloseServiceHandle RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegCloseKey ChangeServiceConfig2A RegCreateKeyW DeleteService QueryServiceStatusEx StartServiceW QueryServiceStatus CreateServiceW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus RegQueryValueExW RegEnumKeyExW RegOpenKeyW RegSetValueExW ChangeServiceConfigA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges DuplicateTokenEx CreateProcessAsUserW ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptAcquireContextA RegSaveKeyW RegRestoreKeyW RegQueryInfoKeyW RegLoadAppKeyW RegEnumValueW RegEnumKeyW TreeSetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo SetNamedSecurityInfoW DeleteAce GetExplicitEntriesFromAclW CreateWellKnownSid LookupAccountNameW InitializeSid AllocateLocallyUniqueId GetSidSubAuthority GetSidSubAuthorityCount RegSetKeyValueW RegGetValueW RegDeleteValueW RegUnLoadKeyW RegLoadKeyW IsTextUnicode SetEntriesInAclW SetServiceObjectSecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor AreAllAccessesGranted MapGenericMask GetNamedSecurityInfoW ConvertStringSidToSidW ConvertSidToStringSidW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptReleaseContext RevertToSelf IsWellKnownSid QueryServiceConfigW QueryServiceConfig2W ChangeServiceConfig2W ChangeServiceConfigW ImpersonateLoggedOnUser FreeSid CheckTokenMembership AllocateAndInitializeSid GetTokenInformation OpenThreadToken OpenSCManagerW

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree CoCreateInstance CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitializeEx CoGetClassObject PropVariantClear

oleaut32

SafeArrayGetLBound SafeArrayDestroy SafeArrayCreate VariantTimeToSystemTime SafeArrayLock SysAllocStringLen SystemTimeToVariantTime SafeArrayGetVartype VariantInit SysStringLen SysAllocString SysFreeString VariantClear SafeArrayGetUBound SafeArrayUnlock

mpr

WNetGetConnectionW

shlwapi

StrDupW

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winhttp

WinHttpSetCredentials WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpSetOption WinHttpCloseHandle WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpQueryHeaders WinHttpQueryDataAvailable

netapi32

NetApiBufferFree NetWkstaGetInfo

psapi

GetProcessImageFileNameW

sfc

SfcIsFileProtected

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

setupapi

SetupFindNextLine SetupGetIntField SetupGetStringFieldW SetupFindFirstLineW SetupCloseInfFile SetupOpenInfFileW SetupGetMultiSzFieldW SetupGetLineTextW

authz

AuthzInitializeContextFromSid AuthzAccessCheck AuthzFreeContext AuthzFreeResourceManager AuthzInitializeResourceManager

wintrust

CryptCATAdminReleaseContext CryptCATAdminAcquireContext CryptCATAdminAddCatalog CryptCATAdminRemoveCatalog WinVerifyTrust CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext

bcrypt

BCryptImportKeyPair BCryptGetProperty BCryptVerifySignature BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCreateHash BCryptHashData BCryptDestroyHash

ws2_32

getservbyname freeaddrinfo getaddrinfo ntohl inet_addr WSASendTo WSASend bind gethostbyname socket shutdown setsockopt ntohs htons WSACleanup getservbyport gethostbyaddr inet_ntoa WSASetLastError accept htonl WSAStartup WSAGetLastError sendto select WSAIoctl WSARecv send recvfrom recv listen getsockopt getsockname getpeername ioctlsocket closesocket WSASocketA WSARecvFrom connect

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

109KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

922KB

Virtual Size

922KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

632KB

Virtual Size

636KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_d98e574d4033a61dc4bea3af6c78672b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

crypt32

iphlpapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

shlwapi

rpcrt4

wtsapi32

userenv

winhttp

netapi32

psapi

sfc

version

setupapi

authz

wintrust

bcrypt

ws2_32

generic