2026-07-29_7fa1663d1c7cc60468d6da2f2840ee3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_7fa1663d1c7cc60468d6da2f2840ee3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 1.3MB
Sample260730-acb7naha22
SHA256 674c745bd091f8e9cc1ea2319f3071e3ebc9c8482d11385ea268d8722a3d9600
MD5 7fa1663d1c7cc60468d6da2f2840ee3e
SHA1 6dabd148d4c0d683b0cadbc22e8b4f6920086ed4
SHA512 1b195434b0c042e73484f43398174d8b83c2bafdda0ca16c2440892ebf58caa18d3984d45208143f462af6cd9fac469da980a47ae05171d6e85488485944e565
SSDEEP 24576:pdrxyCzei2NV5Iw0lGxblPJM/SvlL7A8ygdFwfkNBh0lhSMXlHnbQ6K1Kiuv3LC5:pLCi2NnIw0lGxblPJM/SvlL7Vyg3IXba
TLSH
T100557C12379911ECE06F81B88B4E16F3D335F40E17905ADF179426661F96EEC9EBA320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_7fa1663d1c7cc60468d6da2f2840ee3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-29_7fa1663d1c7cc60468d6da2f2840ee3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.3MB

2026-07-29_7fa1663d1c7cc60468d6da2f2840ee3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 4a6ce282240f737d3335f8e389469300
SHA256 674c745bd091f8e9cc1ea2319f3071e3ebc9c8482d11385ea268d8722a3d9600
MD5 7fa1663d1c7cc60468d6da2f2840ee3e
SHA1 6dabd148d4c0d683b0cadbc22e8b4f6920086ed4
SHA512 1b195434b0c042e73484f43398174d8b83c2bafdda0ca16c2440892ebf58caa18d3984d45208143f462af6cd9fac469da980a47ae05171d6e85488485944e565
SSDEEP 24576:pdrxyCzei2NV5Iw0lGxblPJM/SvlL7A8ygdFwfkNBh0lhSMXlHnbQ6K1Kiuv3LC5:pLCi2NnIw0lGxblPJM/SvlL7Vyg3IXba
TLSH
T100557C12379911ECE06F81B88B4E16F3D335F40E17905ADF179426661F96EEC9EBA320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

564808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpQueryOption WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

bcrypt

BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptCreateHash BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptVerifySignature BCryptGenRandom

advapi32

GetSidSubAuthority GetTokenInformation RegGetValueW RegQueryValueExW EventUnregister EventWriteTransfer EventSetInformation EventRegister GetSidSubAuthorityCount LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey QueryServiceStatus CloseServiceHandle RegQueryValueExA ClearEventLogW OpenSCManagerW OpenSCManagerA RegCreateKeyExW CloseEventLog ControlService RegSetValueExW OpenProcessToken OpenEventLogW RegOpenKeyExA RegOpenKeyExW ChangeServiceConfigW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceA

shell32

ShellExecuteExA SHGetFolderPathW

user32

UnregisterHotKey PostMessageW MapVirtualKeyW DestroyWindow GetDC IsWindowVisible SetWindowPos SetWindowLongPtrW CreateWindowExW CallNextHookEx GetSystemMetrics GetWindowLongPtrW RegisterClassExW wsprintfA ShowWindow IsWindow GetAsyncKeyState GetMessageW SetTimer ExitWindowsEx PeekMessageW RegisterHotKey UnhookWindowsHookEx TranslateMessage FindWindowW LoadCursorW SetWindowsHookExW GetClientRect UpdateLayeredWindow GetKeyNameTextW KillTimer PostQuitMessage SystemParametersInfoW SetWinEventHook UpdateWindow UnhookWinEvent SetForegroundWindow ReleaseDC DefWindowProcW DispatchMessageW

kernel32

GetCommandLineA InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency QueryPerformanceCounter GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx CreateDirectoryW ReadFile SizeofResource SetConsoleCtrlHandler FindFirstFileW SetHandleInformation VirtualProtect FindNextFileW GetCurrentProcess WriteFile ExpandEnvironmentStringsW WriteConsoleW RemoveDirectoryW GetModuleFileNameW GetOEMCP GetProcessId K32GetModuleFileNameExW Thread32Next CreatePipe GetTempPathW Thread32First FindClose WaitForSingleObject CreateFileW GetFileAttributesW UnmapViewOfFile OpenProcess SetProcessMitigationPolicy CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW GetCurrentThread LockResource DeleteFileA GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle LoadResource FindResourceW SetFileAttributesA GetThreadContext GetWindowsDirectoryW Beep GetProcAddress GlobalLock CreateFileMappingA GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte CreateProcessA GetSystemTimeAsFileTime K32EnumProcessModules CreateDirectoryA CreateFileMappingW MapViewOfFile GetTickCount GlobalUnlock LoadLibraryExW IsDebuggerPresent ConnectNamedPipe CheckRemoteDebuggerPresent FlushFileBuffers FormatMessageA HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW TerminateProcess GetCommandLineW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetACP IsValidCodePage ReadConsoleW GetExitCodeProcess HeapReAlloc EnumSystemLocalesW CreateNamedPipeW GetUserDefaultLCID GetConsoleMode GetConsoleOutputCP GetEnvironmentVariableW GetTimeZoneInformation HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetFileAttributesW SetEndOfFile OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LocalAlloc LocalFree LoadLibraryW

gdi32

CreateDIBSection CreateCompatibleDC GetStockObject DeleteDC DeleteObject SelectObject

ole32

CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoUninitialize CoTaskMemAlloc

crypt32

CertGetCertificateContextProperty CertFreeCertificateChain CryptEncodeObjectEx CryptStringToBinaryA CertFreeCertificateContext CertGetCertificateChain CertGetNameStringA

wininet

InternetConnectA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetReadFile HttpSendRequestA

gdiplus

GdipClosePathFigure GdipSetClipRegion GdipDrawPath GdipDrawString GdipSetTextRenderingHint GdipMeasureString GdipDeleteRegion GdipGraphicsClear GdipFillRectangleI GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipSetStringFormatAlign GdipSetStringFormatFlags GdipFillPath GdipSetStringFormatTrimming GdipResetPath GdipCreateSolidFill GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipDeleteBrush GdipCreateRegionPath GdipCreateLineBrushI GdipCreateFontFamilyFromName GdipAddPathArcI GdipResetClip GdipDeleteFontFamily GdipCreateStringFormat GdiplusStartup GdipGetImageGraphicsContext

Name

.text

Size

764KB

Virtual Size

764KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_7fa1663d1c7cc60468d6da2f2840ee3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

winhttp

bcrypt

advapi32

shell32

user32

kernel32

gdi32

ole32

crypt32

wininet

gdiplus

generic