2026-08-01_3e0bcbdd4a6604cc4ba2c114d07db77d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_3e0bcbdd4a6604cc4ba2c114d07db77d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.2MB
Sample260801-vnw2esdp2x
SHA256 325fcce2089bb4be78274a7e7264d93718c295454a75eab0908e309f96c7afb1
MD5 3e0bcbdd4a6604cc4ba2c114d07db77d
SHA1 a87e35285f9b27946f139a9da4e944998c7fadb3
SHA512 3dde0adb7ab821e6237fd2418adda7c3f44524fd00d6d84c190799d0c42f98719f05cda84b8fb83fecea7fcf1fb585e24d19764f6f831ee77ee7ba31f610b7a2
SSDEEP 24576:GzA9dKx1cTVUAUo0Kta4Eoi70hS7xGXvVLjNdXmaPpbn+:GM9dKx2BvhS7VNOxdXmaPx
TLSH
T14B55B015B2F801E5E0B7C0794A56850BE9B1BC9613308ADF4290AB663F37AF60F7D761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_3e0bcbdd4a6604cc4ba2c114d07db77d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-01_3e0bcbdd4a6604cc4ba2c114d07db77d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.2MB

2026-08-01_3e0bcbdd4a6604cc4ba2c114d07db77d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH abfa8e499c96e009be215c2ec9f00069
SHA256 325fcce2089bb4be78274a7e7264d93718c295454a75eab0908e309f96c7afb1
MD5 3e0bcbdd4a6604cc4ba2c114d07db77d
SHA1 a87e35285f9b27946f139a9da4e944998c7fadb3
SHA512 3dde0adb7ab821e6237fd2418adda7c3f44524fd00d6d84c190799d0c42f98719f05cda84b8fb83fecea7fcf1fb585e24d19764f6f831ee77ee7ba31f610b7a2
SSDEEP 24576:GzA9dKx1cTVUAUo0Kta4Eoi70hS7xGXvVLjNdXmaPpbn+:GM9dKx2BvhS7VNOxdXmaPx
TLSH
T14B55B015B2F801E5E0B7C0794A56850BE9B1BC9613308ADF4290AB663F37AF60F7D761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

509408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\devel\ark7\bin.win32\Updater.x64.pdb

kernel32

OpenProcess TerminateProcess GetSystemInfo HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceExW FindResourceW LocalAlloc FileTimeToLocalFileTime GetModuleHandleExW lstrcmpW MulDiv VerSetConditionMask VerifyVersionInfoW DeleteCriticalSection InitializeCriticalSectionEx SetFilePointerEx WriteFile lstrlenA RtlCaptureContext GlobalMemoryStatusEx CreateThread ExitProcess SetUnhandledExceptionFilter GetCurrentThreadId Sleep InitializeCriticalSection CreateEventW SetEvent EnterCriticalSection LeaveCriticalSection RaiseException SetLastError GetUserDefaultUILanguage WritePrivateProfileStringW GetWindowsDirectoryW GetUserDefaultLangID lstrcmpiW CreateMutexW GetLocalTime DecodePointer VirtualQuery VirtualProtect WriteConsoleW GetCurrentProcessId GetConsoleMode GetConsoleOutputCP SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetCPInfo GetStringTypeW GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent WaitForSingleObject CreateProcessW MultiByteToWideChar WideCharToMultiByte LoadLibraryW GetSystemDirectoryW LoadLibraryExW SetFileAttributesW lstrcpyW FindNextFileW GetFullPathNameW LocalFree GetFileSizeEx GetFileSize GetFileAttributesW lstrlenW DeleteFileW GetTempFileNameW GetTempPathW GetModuleFileNameW GetCurrentThread GetCurrentProcess FreeLibrary GetProcAddress GetModuleHandleW GetTimeZoneInformation FileTimeToSystemTime GetSystemTimeAsFileTime FindClose ReadFile SetFilePointer CreateFileW GetTickCount64 OutputDebugStringW CloseHandle FlushFileBuffers GetLastError

user32

RemovePropW SetPropW GetCursorPos GetKeyState RegisterClassExW IsWindowEnabled GetWindow UnionRect DestroyCursor SetTimer KillTimer EndPaint BeginPaint GetSysColor SetFocus GetFocus DestroyWindow GetMessageW EnableWindow EndDialog LoadIconW GetPropW PostMessageW EnumChildWindows SetWindowTextW GetDlgCtrlID SetWindowRgn AdjustWindowRectEx GetWindowTextLengthW SetScrollPos SetScrollRange SetScrollInfo GetWindowDC RegisterClassW CreateIconFromResource LoadCursorFromFileW UpdateWindow TrackMouseEvent FindWindowW SendMessageW GetSystemMetrics SystemParametersInfoW GetWindowRect MonitorFromRect GetMonitorInfoW CopyRect MonitorFromPoint OffsetRect EqualRect DialogBoxParamW GetActiveWindow SetParent SetDlgItemTextW GetClassInfoW CharNextW DrawFocusRect MonitorFromWindow MessageBoxW WaitForInputIdle ChangeWindowMessageFilter SendMessageTimeoutW DestroyIcon MoveWindow GetWindowLongW SetWindowPos ScreenToClient ShowWindow CallWindowProcW GetWindowLongPtrW ClientToScreen PeekMessageW TranslateMessage DispatchMessageW PostQuitMessage IsWindow GetParent GetDesktopWindow FindWindowExW GetWindowThreadProcessId IsWindowVisible GetWindowTextW GetWindowPlacement GetForegroundWindow AttachThreadInput SetForegroundWindow BringWindowToTop GetDC ReleaseDC SetWindowLongPtrW DefWindowProcW SetProcessDPIAware SubtractRect SetRect MapWindowPoints UnregisterClassW IntersectRect InflateRect IsRectEmpty PtInRect SetCursor ReleaseCapture SetCapture GetDlgItem InvalidateRect CreateWindowExW SetWindowLongW LoadCursorW SetRectEmpty GetClassLongW GetClassNameW GetClientRect RegisterWindowMessageW DrawTextW GetClassInfoExW

gdi32

CreateCompatibleBitmap SetWindowOrgEx ExcludeClipRect CreateSolidBrush LineTo ExtCreateRegion CombineRgn OffsetRgn SetTextColor SetBkMode CreateFontW CreateRectRgn CreateFontIndirectW GetDeviceCaps BitBlt DeleteDC CreateCompatibleDC CreateDIBSection DeleteObject SelectObject ExtTextOutW SetBkColor GetObjectW GetStockObject MoveToEx GetTextExtentPoint32W GetTextMetricsW

advapi32

RegCloseKey OpenProcessToken GetTokenInformation RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegOpenKeyExW

shell32

ShellExecuteW SHAppBarMessage

ole32

OleUninitialize CoInitialize OleInitialize CoCreateInstance CoUninitialize CoTaskMemRealloc CoTaskMemFree OleCreate OleSetContainedObject CoTaskMemAlloc

oleaut32

VariantInit VariantClear SysAllocString VarUI4FromStr SysFreeString

shlwapi

PathIsDirectoryW PathCanonicalizeW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

_TrackMouseEvent

wininet

InternetWriteFile HttpSendRequestExW HttpSendRequestW InternetErrorDlg HttpQueryInfoW HttpOpenRequestA InternetConnectA InternetSetOptionW InternetOpenW InternetReadFile InternetCloseHandle HttpEndRequestW InternetQueryDataAvailable InternetQueryOptionW HttpAddRequestHeadersW InternetCrackUrlA

uxtheme

DrawThemeBackground OpenThemeData CloseThemeData

Name

.text

Size

683KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

ve_share

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

348KB

Virtual Size

348KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_3e0bcbdd4a6604cc4ba2c114d07db77d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

wininet

uxtheme

generic