2026-07-30_938d0076b183099d44db5005a5c6fe38_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-07-30_938d0076b183099d44db5005a5c6fe38_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.8MB
Sample260730-vvy5cstakd
SHA256 17a3d21effec19facc0e265880363f45875266ce49f318db01fedff31b9f5952
MD5 938d0076b183099d44db5005a5c6fe38
SHA1 4c5a78877fa2738252baec90a77aeb965de9467f
SHA512 84001ca2428cb82f86a211011517f3b508243354f9a01c64e4b1d837e11153de4882cd734a32eba7c50f0ac2dabaf2d9b57a0927d2f809ea42b78ee53fbe310c
SSDEEP 98304:JrZUzLy1+3zPpFy4SGuRPQX8BjY5LXeN+1:dmLy1+3zPpFy4LKPQXqYJXeN
TLSH
T12736AE17A7A501E8C876C238C55A8203E7B2BC1557709BCF16A4567A2FB3AE54F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_938d0076b183099d44db5005a5c6fe38_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-30_938d0076b183099d44db5005a5c6fe38_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.8MB

2026-07-30_938d0076b183099d44db5005a5c6fe38_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH c36da8c99f60478851cefcef686e4886
SHA256 17a3d21effec19facc0e265880363f45875266ce49f318db01fedff31b9f5952
MD5 938d0076b183099d44db5005a5c6fe38
SHA1 4c5a78877fa2738252baec90a77aeb965de9467f
SHA512 84001ca2428cb82f86a211011517f3b508243354f9a01c64e4b1d837e11153de4882cd734a32eba7c50f0ac2dabaf2d9b57a0927d2f809ea42b78ee53fbe310c
SSDEEP 98304:JrZUzLy1+3zPpFy4SGuRPQX8BjY5LXeN+1:dmLy1+3zPpFy4LKPQXqYJXeN
TLSH
T12736AE17A7A501E8C876C238C55A8203E7B2BC1557709BCF16A4567A2FB3AE54F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2425916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB4_MbamBgNativeMsg\bin\x64\Release\MbamBgNativeMsg.pdb

kernel32

SetEvent Sleep SwitchToThread HeapAlloc HeapFree GetProcessHeap LocalFree CreateFileW CloseHandle DisconnectNamedPipe CancelSynchronousIo ResetEvent WaitForSingleObject WaitForSingleObjectEx CreateMutexA CreateEventW WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId CreateThread OpenProcess GlobalFree MultiByteToWideChar MoveFileExW CopyFileW WideCharToMultiByte SetFilePointer FlushFileBuffers GetFileSizeEx ReadFile WriteFile GetFileInformationByHandle GetProcAddress GetModuleHandleW LoadLibraryW FormatMessageW CallNamedPipeW CreateNamedPipeW ConnectNamedPipe GetOverlappedResult GetWindowsDirectoryW GetDriveTypeW FreeLibrary FindNextFileW FindClose OpenThread SetThreadPriority IsWow64Process GetNativeSystemInfo GetSystemInfo SetLastError GetLogicalDriveStringsW QueryDosDeviceW GetCurrentThread GetModuleFileNameW GetSystemDirectoryW GetTickCount GetLocalTime LeaveCriticalSection SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation FindFirstFileW GetFileAttributesW CreateDirectoryW RemoveDirectoryW DeleteFileW GetVersionExW VerSetConditionMask VerifyVersionInfoW GetFileSize lstrcmpA OutputDebugStringW GetCurrentThreadId SetEndOfFile GetStdHandle GetModuleHandleA GetCurrentDirectoryW GetSystemTimeAsFileTime ReleaseMutex CreateMutexW InitializeCriticalSectionAndSpinCount TerminateProcess GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW SetEnvironmentVariableW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualProtect VirtualFree GetFileType GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx GetLastError GetSystemTime DecodePointer RaiseException VirtualQuery LoadLibraryExA IsDebuggerPresent GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency FindFirstFileExW GetFullPathNameW EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx LoadLibraryExW ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler PeekNamedPipe SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP SetFilePointerEx SetStdHandle HeapReAlloc HeapSize IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

620KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_938d0076b183099d44db5005a5c6fe38_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

generic