2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 1.1MB
Sample260730-gpdpksdn8t
SHA256 7ca7e5cf7fcc712bc3fcf07900066879c771642563c6d192bbb4fc234b3e8af9
MD5 1079d7988bafba2887275617846c887f
SHA1 d79ebc864d8d578108d3fcfff8730be41cd3fa64
SHA512 bb03f427209bcc6904386c92bc9b20140c8445608e1348e5ab9894ffdbfd144fba717910cb4e2b104462af06b39312c946ecece4ecd69f7a658eebb702109ba0
SSDEEP 24576:iXoLtxz1wzrWVC9Dgh0lhSMXlsr+K1Kiuv3LC5:iyxBwzqqDVcdKvDY
TLSH
T184359E2A67A901FDF0ABD17C99975A01F379B40B13518ADF139412663F9B2E19F3A330
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.1MB

2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH cd0598f1a4dc339fd3eccee6a725e071
SHA256 7ca7e5cf7fcc712bc3fcf07900066879c771642563c6d192bbb4fc234b3e8af9
MD5 1079d7988bafba2887275617846c887f
SHA1 d79ebc864d8d578108d3fcfff8730be41cd3fa64
SHA512 bb03f427209bcc6904386c92bc9b20140c8445608e1348e5ab9894ffdbfd144fba717910cb4e2b104462af06b39312c946ecece4ecd69f7a658eebb702109ba0
SSDEEP 24576:iXoLtxz1wzrWVC9Dgh0lhSMXlsr+K1Kiuv3LC5:iyxBwzqqDVcdKvDY
TLSH
T184359E2A67A901FDF0ABD17C99975A01F379B40B13518ADF139412663F9B2E19F3A330
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

369768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpQueryOption WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

bcrypt

BCryptGenerateSymmetricKey BCryptVerifySignature BCryptCreateHash BCryptDestroyKey BCryptEncrypt BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenRandom

advapi32

GetSidSubAuthority GetTokenInformation RegGetValueW RegQueryValueExW EventUnregister EventWriteTransfer EventSetInformation EventRegister GetSidSubAuthorityCount LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey QueryServiceStatus CloseServiceHandle RegQueryValueExA ClearEventLogW OpenSCManagerW OpenSCManagerA RegCreateKeyExW CloseEventLog ControlService RegSetValueExW OpenProcessToken OpenEventLogW RegOpenKeyExA RegOpenKeyExW ChangeServiceConfigW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceA

shell32

ShellExecuteExA SHGetFolderPathW

user32

UnregisterHotKey PostMessageW MapVirtualKeyW DestroyWindow GetDC IsWindowVisible SetWindowPos CreateWindowExW CallNextHookEx GetSystemMetrics RegisterClassExW wsprintfA ShowWindow IsWindow GetAsyncKeyState DispatchMessageW GetMessageW ExitWindowsEx PeekMessageW RegisterHotKey UnhookWindowsHookEx TranslateMessage FindWindowW LoadCursorW SetWindowsHookExW GetClientRect UpdateLayeredWindow GetKeyNameTextW KillTimer PostQuitMessage SystemParametersInfoW SetWinEventHook UpdateWindow UnhookWinEvent SetForegroundWindow ReleaseDC DefWindowProcW SetTimer

kernel32

WriteConsoleW GetOEMCP InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency QueryPerformanceCounter AreFileApisANSI GetFileAttributesExW CreateDirectoryW ReadFile SizeofResource SetConsoleCtrlHandler FindFirstFileW SetHandleInformation HeapSize GetCurrentProcess GetACP ExpandEnvironmentStringsW TerminateProcess RemoveDirectoryW GetModuleFileNameW CreateNamedPipeW GetProcessId Thread32Next CreatePipe GetTempPathW Thread32First FindClose WaitForSingleObject CreateFileW UnmapViewOfFile OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW LockResource DeleteFileA DeleteFileW Process32FirstW CloseHandle LoadResource FindResourceW SetFileAttributesA GetWindowsDirectoryW Beep GetProcAddress CreateFileMappingA GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA CreateFileMappingW MapViewOfFile GetTickCount LoadLibraryExW ConnectNamedPipe FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FindNextFileW GetCommandLineA IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW IsValidCodePage ReadConsoleW GetExitCodeProcess HeapReAlloc EnumSystemLocalesW WriteFile GetUserDefaultLCID GetDateFormatW VirtualProtect GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx FindFirstFileExW GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection EnterCriticalSection GetFileAttributesW SetEndOfFile OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LocalAlloc LocalFree LoadLibraryW GetEnvironmentVariableW FormatMessageA GetLocaleInfoEx LeaveCriticalSection

gdi32

CreateDIBSection CreateCompatibleDC GetStockObject DeleteDC DeleteObject SelectObject

ole32

CoInitializeEx CoTaskMemFree CoUninitialize

crypt32

CertFreeCertificateChain CryptStringToBinaryA CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetNameStringA

wininet

HttpSendRequestA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetConnectA InternetReadFile

gdiplus

GdipClosePathFigure GdipSetClipRegion GdipDrawPath GdipDrawString GdipSetTextRenderingHint GdipMeasureString GdipGraphicsClear GdipGetImageGraphicsContext GdipFillRectangleI GdipDeleteGraphics GdipDeletePen GdipDeleteFont GdipCreateBitmapFromScan0 GdipCreatePen1 GdipSetStringFormatAlign GdipSetStringFormatFlags GdipFillPath GdipSetStringFormatTrimming GdipResetPath GdipCreateSolidFill GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipSetSmoothingMode GdipDisposeImage GdipDeletePath GdipDeleteBrush GdipCreateRegionPath GdipCreateLineBrushI GdipCreateFontFamilyFromName GdipAddPathArcI GdipResetClip GdipDeleteFontFamily GdipCreateStringFormat GdiplusStartup GdipDeleteRegion GdipDeleteStringFormat

Name

.text

Size

571KB

Virtual Size

571KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

260KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_1079d7988bafba2887275617846c887f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

winhttp

bcrypt

advapi32

shell32

user32

kernel32

gdi32

ole32

crypt32

wininet

gdiplus

generic