2026-07-23_3b5c5f585841744ec523dd03466d648f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_3b5c5f585841744ec523dd03466d648f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 11.4MB
Sample260723-ymactawcne
SHA256 854b383dafb1dfa0a38bc17ea869bc668c911be4fbdeb7238a4f7e41e15d9529
MD5 3b5c5f585841744ec523dd03466d648f
SHA1 ca72838a38eb53ba242aeb4ade6a9b845f46fb7b
SHA512 7349449b56576d6a33a289db8450fa6eb7f88e6c0608101aa3e93817b23e78b720c3d1ede501cf6228c6cbebbdd2049827944f66a123889e897f342e9bef6fc3
SSDEEP 98304:8A64Z/iUYtDJODZi1EZknsc8tUFswknM9++k:164dSJODZi1EZGsc82FZyM9++k
TLSH
T109C6F606A7F951D8F5BAD674AD7B652AEE32BC618B3093CF1150560B0F32ED48E38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_3b5c5f585841744ec523dd03466d648f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-23_3b5c5f585841744ec523dd03466d648f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 11.4MB

2026-07-23_3b5c5f585841744ec523dd03466d648f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH fb24d1de2b22c94fca9d827148c5b50c
SHA256 854b383dafb1dfa0a38bc17ea869bc668c911be4fbdeb7238a4f7e41e15d9529
MD5 3b5c5f585841744ec523dd03466d648f
SHA1 ca72838a38eb53ba242aeb4ade6a9b845f46fb7b
SHA512 7349449b56576d6a33a289db8450fa6eb7f88e6c0608101aa3e93817b23e78b720c3d1ede501cf6228c6cbebbdd2049827944f66a123889e897f342e9bef6fc3
SSDEEP 98304:8A64Z/iUYtDJODZi1EZknsc8tUFswknM9++k:164dSJODZi1EZGsc82FZyM9++k
TLSH
T109C6F606A7F951D8F5BAD674AD7B652AEE32BC618B3093CF1150560B0F32ED48E38721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5907424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\JENKINS\workspace\N_MBAMService\bin\x64\Release\MBAMService.pdb

ws2_32

select gethostbyname WSAGetLastError htonl inet_ntoa getsockopt getservbyport WSASetLastError recv send closesocket connect setsockopt socket shutdown getpeername recvfrom sendto getsockname ioctlsocket getservbyname ntohs WSCSetApplicationCategory htons ntohl inet_addr WSACleanup WSAStartup getnameinfo freeaddrinfo getaddrinfo gethostbyaddr

crypt32

CertFreeCertificateContext CryptMsgClose CryptQueryObject CertFindCertificateInStore CryptMsgGetParam CryptDecodeObjectEx CryptDecodeObject CertDuplicateCertificateContext CertOpenStore CertCloseStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertGetNameStringW CertOpenSystemStoreW

iphlpapi

GetAdaptersInfo

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptImportKeyPair BCryptGetProperty BCryptFinishHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptDestroyHash

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader RtlUnwindEx RtlCaptureContext VerSetConditionMask RtlUnwind

kernel32

CopyFileW GetLocalTime GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation SetFileTime GetVersionExW GetFileSizeEx CreateFileMappingW MapViewOfFile SetFileInformationByHandle OpenThread GetWindowsDirectoryW GetLongPathNameW RemoveDirectoryW GetNamedPipeServerProcessId DuplicateHandle CreateWaitableTimerW SetWaitableTimer FindNextFileW FindClose SetFilePointer FlushFileBuffers GetFileInformationByHandle QueryPerformanceFrequency QueryPerformanceCounter GetFileSize lstrcmpA SetFileAttributesW SetEndOfFile DeleteFileW GetFileInformationByHandleEx FindFirstFileW GetFileAttributesW GetFileAttributesExW CreateDirectoryW GetVolumePathNameW GetDriveTypeW GetLogicalDrives GetStdHandle GetModuleHandleA GetSystemWindowsDirectoryW GetCurrentDirectoryW InitializeCriticalSectionAndSpinCount ReleaseMutex CreateMutexW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetEnvironmentVariableW SetEnvironmentVariableW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualAlloc VirtualProtect VirtualFree GetFileType GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA GetConsoleMode GetSystemDirectoryW ReadConsoleA ReadConsoleW DeviceIoControl IsDebuggerPresent GetFullPathNameW FindFirstFileExW GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive GetStringTypeW EncodePointer LCMapStringEx GetSystemFirmwareTable VerifyVersionInfoW GetSystemTimeAsFileTime GetSystemInfo GetProcessTimes ProcessIdToSessionId SetThreadPriority GetCurrentThread WaitForMultipleObjects TerminateProcess SetProcessWorkingSetSize CreateThread GetCurrentProcess RaiseException DecodePointer GetCommandLineW QueryFullProcessImageNameW GetTickCount64 OpenProcess WaitForSingleObjectEx ResetEvent GetOverlappedResult CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe WriteFile ReadFile CreateEventW WaitForSingleObject LoadLibraryW UnmapViewOfFile CloseHandle OutputDebugStringA GetTempPathW ExpandEnvironmentStringsW FormatMessageW LocalFree LocalAlloc TzSpecificLocalTimeToSystemTime GetTickCount GetCurrentThreadId GetCurrentProcessId GlobalFree GlobalAlloc WideCharToMultiByte SetEvent MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary SwitchToThread Sleep DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetLastError OutputDebugStringW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP SetFilePointerEx SetStdHandle IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW MoveFileExW GetExitCodeProcess CreateProcessW QueryDosDeviceW GetLogicalDriveStringsW Module32NextW Process32NextW Process32FirstW SetLastError CreateFileW GetNativeSystemInfo IsWow64Process VirtualQueryEx Module32FirstW CreateToolhelp32Snapshot K32EnumProcesses SetConsoleMode GetProcessIoCounters GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread VirtualQuery InterlockedPushEntrySList InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter GetCPInfo UnhandledExceptionFilter AreFileApisANSI

user32

RegisterPowerSettingNotification UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterPowerSettingNotification CharUpperW wsprintfW CloseDesktop GetUserObjectInformationW OpenInputDesktop DispatchMessageW TranslateMessage GetMessageW LoadStringW CharNextW PostThreadMessageW OpenWindowStationW CloseWindowStation SetProcessWindowStation GetProcessWindowStation MessageBoxW

advapi32

CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptAcquireContextA AreAllAccessesGranted MapGenericMask RegSaveKeyW RegRestoreKeyW RegLoadAppKeyW RegEnumValueW RegEnumKeyW TreeSetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo SetNamedSecurityInfoW GetNamedSecurityInfoW DeleteAce GetExplicitEntriesFromAclW LsaNtStatusToWinError CreateWellKnownSid LookupAccountNameW InitializeSid AllocateLocallyUniqueId GetSidSubAuthority GetSidSubAuthorityCount ConvertStringSidToSidW ConvertSidToStringSidW RevertToSelf ImpersonateLoggedOnUser IsWellKnownSid SetEntriesInAclW ConvertSecurityDescriptorToStringSecurityDescriptorW QueryServiceObjectSecurity SetServiceObjectSecurity QueryServiceStatusEx QueryServiceConfigW StartServiceW RegUnLoadKeyW RegLoadKeyW IsTextUnicode CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptReleaseContext LookupAccountSidW FreeSid CheckTokenMembership AllocateAndInitializeSid GetTokenInformation OpenThreadToken ChangeServiceConfig2W ChangeServiceConfigW LookupPrivilegeValueW DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegisterServiceCtrlHandlerW QueryServiceConfig2W OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2A ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoRevertToSelf CoImpersonateClient CoRegisterClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoInitializeSecurity StringFromGUID2 CoSetProxyBlanket PropVariantClear CoRevokeClassObject

shell32

SHGetFolderPathW

oleaut32

VarUI4FromStr LoadRegTypeLi SysAllocStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayCreateEx SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantCopy LoadTypeLi SafeArrayCopy SafeArrayGetElemsize RegisterTypeLi UnRegisterTypeLi SafeArrayGetVartype SafeArrayCreate VariantClear SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetDim SafeArrayRedim SafeArrayDestroy GetRecordInfoFromGuids SysAllocString SysFreeString SysStringLen SysStringByteLen SysAllocStringByteLen

mpr

WNetGetConnectionW

powrprof

CallNtPowerInformation

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpSetOption WinHttpOpen WinHttpOpenRequest WinHttpSetCredentials WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpCloseHandle

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateProcessesW WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock

pdh

PdhCollectQueryData PdhCloseQuery PdhOpenQueryW PdhGetFormattedCounterValue PdhAddCounterW

psapi

GetMappedFileNameW EnumProcessModulesEx GetProcessImageFileNameW GetModuleFileNameExW

rpcrt4

RpcStringFreeW UuidToStringW

netapi32

NetApiBufferFree NetWkstaGetInfo

setupapi

SetupCloseInfFile SetupOpenInfFileW SetupGetLineTextW SetupFindFirstLineW SetupGetStringFieldW SetupGetIntField SetupGetMultiSzFieldW SetupFindNextLine

wintrust

CryptCATAdminReleaseCatalogContext CryptCATAdminAcquireContext CryptCATAdminAddCatalog CryptCATAdminReleaseContext WinVerifyTrust CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminRemoveCatalog

sfc

SfcIsFileProtected

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW GetFileVersionInfoSizeExW

authz

AuthzFreeContext AuthzAccessCheck AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthzFreeResourceManager

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

231KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

372KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

648KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_3b5c5f585841744ec523dd03466d648f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

ws2_32

crypt32

iphlpapi

bcrypt

ntdll

kernel32

user32

advapi32

ole32

shell32

oleaut32

mpr

powrprof

winhttp

wtsapi32

userenv

pdh

psapi

rpcrt4

netapi32

setupapi

wintrust

sfc

version

authz

generic