2026-07-27_9633b7c37a2a33479de786e911a0d684_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_9633b7c37a2a33479de786e911a0d684_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 5.1MB
Sample260727-eaz8xsgn7z
SHA256 0d68497f700cd054f0e536db1559b154fe544f2f896498ba82e9176c38c81f92
MD5 9633b7c37a2a33479de786e911a0d684
SHA1 ab9bfba289ad60d9a3e1b04ec56bd94dce55f6ee
SHA512 05e0c630e4e8bfb34f1870df9c0a097be6c5058aa562b2d49394344cec1241651336aa3c1691b63127758521a43389f358ded71417f43b129556c5911df8be13
SSDEEP 49152:zMCHQf3scoXBbkaY+zmcV4y3VkT8+HE3uxuMvAKrTZrNyA+2dWhT8p5QyKnLOsbH:YPyVjVMxdAGTZ3bq5o4iaJ
TLSH
T1DD36F005B2A746A8DF73873C84512223E6B17CCA47B097C75B9E4A656F67AF04E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_9633b7c37a2a33479de786e911a0d684_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-07-27_9633b7c37a2a33479de786e911a0d684_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 5.1MB

2026-07-27_9633b7c37a2a33479de786e911a0d684_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH f93cf8200c91ca7fd01da971e3280811
SHA256 0d68497f700cd054f0e536db1559b154fe544f2f896498ba82e9176c38c81f92
MD5 9633b7c37a2a33479de786e911a0d684
SHA1 ab9bfba289ad60d9a3e1b04ec56bd94dce55f6ee
SHA512 05e0c630e4e8bfb34f1870df9c0a097be6c5058aa562b2d49394344cec1241651336aa3c1691b63127758521a43389f358ded71417f43b129556c5911df8be13
SSDEEP 49152:zMCHQf3scoXBbkaY+zmcV4y3VkT8+HE3uxuMvAKrTZrNyA+2dWhT8p5QyKnLOsbH:YPyVjVMxdAGTZ3bq5o4iaJ
TLSH
T1DD36F005B2A746A8DF73873C84512223E6B17CCA47B097C75B9E4A656F67AF04E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

689104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

ntdll

RtlVirtualUnwind RtlPcToFileHeader RtlLookupFunctionEntry RtlAddFunctionTable RtlCaptureContext NtCreateThreadEx RtlUnwindEx RtlUnwind

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

kernel32

SetConsoleTextAttribute GetCurrentThreadId Sleep HeapFree InitializeCriticalSectionEx HeapSize GetLastError HeapReAlloc HeapAlloc DecodePointer AddVectoredExceptionHandler HeapDestroy DeleteCriticalSection GetProcessHeap SetUnhandledExceptionFilter MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter OpenProcess CloseHandle VirtualProtectEx ReadProcessMemory GetExitCodeProcess WriteProcessMemory VirtualAllocEx VirtualFreeEx CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcess LocalFree GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW WriteFile GetStdHandle GetModuleFileNameW ExitProcess IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW GetStringTypeW GetCPInfo CompareStringEx EncodePointer LeaveCriticalSection EnterCriticalSection LCMapStringEx WakeAllConditionVariable GetFileInformationByHandleEx GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW WriteConsoleW SetEndOfFile GetConsoleMode GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetFileSizeEx ReadConsoleW SetFilePointerEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW

user32

DispatchMessageA GetKeyboardLayout FindWindowA SetWindowLongPtrA GetWindowLongPtrA PeekMessageA TranslateMessage SetLayeredWindowAttributes GetForegroundWindow GetAsyncKeyState GetSystemMetrics EnumDisplayMonitors GetMonitorInfoW MapWindowPoints MoveWindow DefWindowProcA CreateWindowExA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxA SetWindowPos

advapi32

GetUserNameA IsValidSid CopySid GetTokenInformation ConvertSidToStringSidA GetLengthSid OpenProcessToken

userenv

UnloadUserProfile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

893KB

Virtual Size

893KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_9633b7c37a2a33479de786e911a0d684_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

d3d11

d3dx11_43

d3dcompiler_43

ntdll

winhttp

kernel32

user32

advapi32

userenv

imm32

dwmapi

generic