2026-07-23_80e28db4b205d5541c99c0fc305a2412_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-23_80e28db4b205d5541c99c0fc305a2412_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
Size 558KB
Sample260724-acmndsdf97
SHA256 3b306a0969a9650408170998f0b8d80c681798ba3e0a53f4f550a015dddb92e8
MD5 80e28db4b205d5541c99c0fc305a2412
SHA1 94fb12d5df69701e9b702c3ec63215c2df025212
SHA512 05a88bacf8b58065f65a217dca726058e0183a042d8e2b8c029c764492792231000c14f6771d94d6ec29862c2528e144b34ee50e2815e4b530665fe8aea05f8f
SSDEEP 6144:0D9J4tmz5QIpiYbRxGN4sYoV+Pa1GM9zAEup1bN3CQI41qQLgtsH5ZaHYwG:0D9TtQ8icxiVd4FNf1qQjwH7G
TLSH
T16EC46B16F3A610F9D17B8238C9520A26FB72BC2607609BDF17A446A51F277D09F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_80e28db4b205d5541c99c0fc305a2412_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-23_80e28db4b205d5541c99c0fc305a2412_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

.exe 558KB

2026-07-23_80e28db4b205d5541c99c0fc305a2412_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 58ac8172ef321b04b0ca7db0802ff187
SHA256 3b306a0969a9650408170998f0b8d80c681798ba3e0a53f4f550a015dddb92e8
MD5 80e28db4b205d5541c99c0fc305a2412
SHA1 94fb12d5df69701e9b702c3ec63215c2df025212
SHA512 05a88bacf8b58065f65a217dca726058e0183a042d8e2b8c029c764492792231000c14f6771d94d6ec29862c2528e144b34ee50e2815e4b530665fe8aea05f8f
SSDEEP 6144:0D9J4tmz5QIpiYbRxGN4sYoV+Pa1GM9zAEup1bN3CQI41qQLgtsH5ZaHYwG:0D9TtQ8icxiVd4FNf1qQjwH7G
TLSH
T16EC46B16F3A610F9D17B8238C9520A26FB72BC2607609BDF17A446A51F277D09F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA WriteFile GetTempPathA CloseHandle Sleep CreateProcessA lstrcatA WriteConsoleW CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

wsprintfA

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

495KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_80e28db4b205d5541c99c0fc305a2412_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

user32

generic