2026-08-01_2e064a41dda3b52e58677f0d43ec481c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_2e064a41dda3b52e58677f0d43ec481c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom
Size 1.7MB
Sample260801-d5cwfavyas
SHA256 336b521f4ba7f9012d2983d48c78a4f80f644fb217c5d8e518a86e64775a7d91
MD5 2e064a41dda3b52e58677f0d43ec481c
SHA1 80da5e05f992427509dbdd891e09423cc5fb5e86
SHA512 51084164a3f6f0aa5a48321c9fd68544741fa231ed7f2da47c0225db872c7c167b90a0fe3db68da50ed06050234908f4ad92e163828ab5ed6d5841cb3b67f9b9
SSDEEP 24576:TyZcwK0d8Wu+f8URQLqXNvzTLIY6BEetWN:ThIu+0QQ2yYf0K
TLSH
T1D585C60BEA7551E1C1BAD038D582652FFC7034A683315BD7A68A9B171B237F4E93EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_2e064a41dda3b52e58677f0d43ec481c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

File Explorer

2026-08-01_2e064a41dda3b52e58677f0d43ec481c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

.exe 1.7MB

2026-08-01_2e064a41dda3b52e58677f0d43ec481c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

IMPHASH f46fe428f9381320c9a0a6361911af52
SHA256 336b521f4ba7f9012d2983d48c78a4f80f644fb217c5d8e518a86e64775a7d91
MD5 2e064a41dda3b52e58677f0d43ec481c
SHA1 80da5e05f992427509dbdd891e09423cc5fb5e86
SHA512 51084164a3f6f0aa5a48321c9fd68544741fa231ed7f2da47c0225db872c7c167b90a0fe3db68da50ed06050234908f4ad92e163828ab5ed6d5841cb3b67f9b9
SSDEEP 24576:TyZcwK0d8Wu+f8URQLqXNvzTLIY6BEetWN:ThIu+0QQ2yYf0K
TLSH
T1D585C60BEA7551E1C1BAD038D582652FFC7034A683315BD7A68A9B171B237F4E93EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1051524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FormatMessageA FormatMessageW WideCharToMultiByte SetLastError CreateIoCompletionPort GetQueuedCompletionStatus InitializeSRWLock SleepEx CreateEventW SetWaitableTimer CreateWaitableTimerA GetCurrentThreadId CreateToolhelp32Snapshot Process32FirstW Process32NextW MultiByteToWideChar GetFileAttributesA TerminateProcess CreateProcessA OpenProcess GetEnvironmentVariableA QueryFullProcessImageNameA GetComputerNameW SetEndOfFile WriteConsoleW CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW LocalFree GetModuleFileNameA TerminateThread QueueUserAPC WaitForMultipleObjects CreateEventA CreateMutexA FindClose HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetProcAddress ExitProcess GetCurrentProcess GetModuleFileNameW WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive PostQueuedCompletionStatus GetLastError CloseHandle WriteFile GetStdHandle RtlUnwind IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread WaitForSingleObjectEx Sleep GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime RtlPcToFileHeader RaiseException SleepConditionVariableSRW GetTickCount64 WakeAllConditionVariable InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread

user32

EnumWindows GetWindow GetWindowTextA SetForegroundWindow GetForegroundWindow FindWindowA GetWindowThreadProcessId AttachThreadInput ShowWindow IsIconic BringWindowToTop

advapi32

RegDeleteValueA RegNotifyChangeKeyValue RegOpenKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

shell32

ShellExecuteA

ws2_32

htonl bind accept freeaddrinfo ntohl WSASocketW WSASend WSARecv WSAGetLastError htons shutdown setsockopt select getsockopt ioctlsocket connect closesocket WSACleanup WSAStartup WSAStringToAddressW WSASetLastError listen getaddrinfo

bcrypt

BCryptDestroyKey BCryptCreateHash BCryptEncrypt BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

wininet

InternetSetOptionA

crypt32

CertFreeCertificateContext CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetCertificateContextProperty CertAddCertificateContextToStore PFXImportCertStore CryptUnprotectData CertCloseStore

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse WinHttpConnect

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_2e064a41dda3b52e58677f0d43ec481c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

wininet

crypt32

winhttp

generic