2026-07-27_a4fe26ea67cfff43f04814a360188d82_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_a4fe26ea67cfff43f04814a360188d82_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 5.8MB
Sample260727-1lp3zssalg
SHA256 8419d79bb67a473bc5df0baeb4338816a8873793d372e2d2a5a2b2a43e5a68e7
MD5 a4fe26ea67cfff43f04814a360188d82
SHA1 82b3ab1d194767e65eb5147cd42fdda9256b8bb9
SHA512 1bb5f5a72dbaf7606f3139e064786b7d20d93ad8577b1084c1c87526f16c02d103a4bd121c1e68a798ea2f89384a2f5a7b51476d83723b311ebe74219e2b3bf7
SSDEEP 98304:ZLtZyOcV9zc1HlpZXX3v7f3y9FwNH3600GClddP+80M8xp3TTy:JtoOcV9zc1Hlp1f7z93nC7dP+TM833/y
TLSH
T13C56AFA757F03ADDC22AD0F8C112B13FEB63B4291769B1D781E636A4E713D946278B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_a4fe26ea67cfff43f04814a360188d82_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-27_a4fe26ea67cfff43f04814a360188d82_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 5.8MB

2026-07-27_a4fe26ea67cfff43f04814a360188d82_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 4ae9d2a9f1f85b0d4e09570fd8885b6a
SHA256 8419d79bb67a473bc5df0baeb4338816a8873793d372e2d2a5a2b2a43e5a68e7
MD5 a4fe26ea67cfff43f04814a360188d82
SHA1 82b3ab1d194767e65eb5147cd42fdda9256b8bb9
SHA512 1bb5f5a72dbaf7606f3139e064786b7d20d93ad8577b1084c1c87526f16c02d103a4bd121c1e68a798ea2f89384a2f5a7b51476d83723b311ebe74219e2b3bf7
SSDEEP 98304:ZLtZyOcV9zc1HlpZXX3v7f3y9FwNH3600GClddP+80M8xp3TTy:JtoOcV9zc1Hlp1f7z93nC7dP+TM833/y
TLSH
T13C56AFA757F03ADDC22AD0F8C112B13FEB63B4291769B1D781E636A4E713D946278B01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1536412

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpGetDefaultProxyConfiguration

kernel32

SetDllDirectoryW VirtualQuery LocalFree WideCharToMultiByte OutputDebugStringA GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoA IsDBCSLeadByte VerSetConditionMask FreeLibrary ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW LoadLibraryW SleepEx WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetSystemInfo DeviceIoControl GetCurrentThreadId GetTempPathW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetEndOfFile GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode DeleteFileW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue DecodePointer TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW HeapReAlloc GlobalFree MultiByteToWideChar HeapSize UnmapViewOfFile CreateFileW CreateFileMappingW CreatePipe GetCurrentProcess AddDllDirectory SetDefaultDllDirectories SetHandleInformation GetWindowsDirectoryA QueryPerformanceFrequency GetFileAttributesA GetExitCodeProcess FlushFileBuffers VirtualQueryEx GetTickCount QueryPerformanceCounter VirtualFreeEx GlobalFindAtomA GetModuleHandleW CreateProcessW GetProcessHeap GetCurrentProcessId SetEnvironmentVariableA DeleteCriticalSection GetFileSize MoveFileExW VirtualAllocEx GetProcAddress VirtualProtectEx HeapAlloc CreateThread CloseHandle DeleteFileA LoadLibraryA GetSystemDirectoryA CreateFileA GetLastError GetTickCount64 Sleep GetModuleHandleA GetSystemDirectoryW GetFileAttributesW RtlUnwind WaitForSingleObject GetEnvironmentVariableA SetErrorMode InitializeCriticalSection LeaveCriticalSection RtlAddFunctionTable GetModuleFileNameW TerminateProcess GetSystemTimeAsFileTime WakeAllConditionVariable LCMapStringEx EncodePointer SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetExitCodeThread FormatMessageA VirtualAlloc WriteFile MapViewOfFile CreateProcessA QueryFullProcessImageNameW HeapDestroy InitializeCriticalSectionEx VirtualFree EnterCriticalSection SetLastError AddVectoredExceptionHandler HeapFree VirtualProtect GetFileSizeEx GlobalGetAtomNameA GetModuleFileNameA ReadFile WriteConsoleW TlsGetValue

user32

RegisterRawInputDevices SetLayeredWindowAttributes TranslateMessage LoadCursorW CreateWindowExA PostQuitMessage LoadIconW GetForegroundWindow GetRawInputData DefWindowProcA RegisterClassA MessageBoxA UpdateWindow EnumWindows SetWindowTextA GetWindowTextA DispatchMessageW GetAsyncKeyState ShowWindow GetSystemMetrics SendMessageW DestroyWindow GetMessageW EndPaint GetKeyState GetMessageExtraInfo BeginPaint PeekMessageW IsWindow RegisterClassExW ScreenToClient CreateWindowExW SetWindowLongPtrW SetWindowPos IsWindowVisible GetWindowRect GetWindow DefWindowProcW GetWindowThreadProcessId GetWindowLongW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture GetCursorPos

gdi32

CreateFontA DeleteObject

advapi32

RegCreateKeyW OpenServiceA StartServiceA OpenSCManagerA CloseServiceHandle CreateServiceA GetTokenInformation AddAccessAllowedAce GetLengthSid SetSecurityInfo InitializeAcl OpenProcessToken IsValidSid RegDeleteKeyA ConvertSidToStringSidW CopySid CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey RegCreateKeyExA CryptImportKey CryptEncrypt SystemFunction036 RegOpenKeyW RegDeleteTreeW RegSetKeyValueW RegCloseKey

shell32

ShellExecuteA ShellExecuteW

crypt32

CertAddCertificateContextToStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup bind connect getsockopt getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen recvfrom sendto ioctlsocket gethostname inet_pton ntohl getaddrinfo inet_ntop getpeername freeaddrinfo WSAWaitForMultipleEvents

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptGenRandom

ntdll

NtLoadDriver NtQuerySystemInformation RtlAdjustPrivilege RtlInitUnicodeString NtUnloadDriver

winmm

timeEndPeriod timeBeginPeriod

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

164KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_a4fe26ea67cfff43f04814a360188d82_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

winhttp

kernel32

user32

gdi32

advapi32

shell32

crypt32

ws2_32

bcrypt

ntdll

winmm

d3d11

dwmapi

shlwapi

psapi

wintrust

dnsapi

userenv

imm32

d3dcompiler_47

generic