2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 9.6MB
Sample260802-bd3axa1shx
SHA256 c21293420b40555be9e7e4907a90df0ac626606a672338b1d52291619fc26048
MD5 329ddb57806b74b9f1ef4c801a149be1
SHA1 c306fe87c4ff9880d1d542da111d6f341956994e
SHA512 343eaec6b1889e4f2e33a6d77359633c51e3dd43b58b79b797fc4276d746319801495b6a4c61d5e9992583bed6c8feab185ceec722040b42d1927f97142f9c33
SSDEEP 196608:/wTi/4hvRad8AO2j30of9lN5hitTQbWK10o+jGH9wM4j75b+gVk88gbJCDDF4Fy2:/q2evRad8v2jkof9lN5hitTQbWK10o+v
TLSH
T17BA6AF6A72BC00E9D4AAD178C6575227E3B2785503B197CF16A496EA1F37BE00E3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

File Explorer

2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 9.6MB

2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 19bb03123d326c36144f24f5d5508626
SHA256 c21293420b40555be9e7e4907a90df0ac626606a672338b1d52291619fc26048
MD5 329ddb57806b74b9f1ef4c801a149be1
SHA1 c306fe87c4ff9880d1d542da111d6f341956994e
SHA512 343eaec6b1889e4f2e33a6d77359633c51e3dd43b58b79b797fc4276d746319801495b6a4c61d5e9992583bed6c8feab185ceec722040b42d1927f97142f9c33
SSDEEP 196608:/wTi/4hvRad8AO2j30of9lN5hitTQbWK10o+jGH9wM4j75b+gVk88gbJCDDF4Fy2:/q2evRad8v2jkof9lN5hitTQbWK10o+v
TLSH
T17BA6AF6A72BC00E9D4AAD178C6575227E3B2785503B197CF16A496EA1F37BE00E3F311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.

Digest

17:89:ce:9e:3c:8e:a8:b8:89:ce:19:2d:6f:97:be:4a:c6:1e:a7:40:d8:48:a7:f6:39:24:71:3f:d4:c0:60:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=OP BG-MB BU-SYS SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Apr 23, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

04:e1:d6:69:bc:6c:5b:ca:5d:9c:d2:64:47:77:6b:07

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2024 - Sep 26, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4505812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Jenkins\workspace\sw\CopycatAgent\CopyCatAgent\x64\Release\ADU.pdb

kernel32

FindNextFileA GetFileAttributesA GetCurrentDirectoryW GetProcAddress GetSystemFirmwareTable CreatePipe PackageIdFromFullName GetPackagesByPackageFamily GetCurrentProcessId CreateFile2 PostQueuedCompletionStatus FileTimeToSystemTime CreateFileMappingFromApp GetConsoleWindow MapViewOfFileFromApp FormatMessageA FreeLibrary LoadLibraryExW SetWaitableTimer SetLastError CreateWaitableTimerW InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus TerminateThread QueueUserAPC SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort GetModuleHandleA CancelIoEx SetFileAttributesW CopyFileW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetSystemDirectoryA LoadLibraryA GetStdHandle GetFileType ReleaseSemaphore GetExitCodeThread CreateSemaphoreA VirtualProtect VirtualFree GetEnvironmentVariableW SwitchToFiber DeleteFiber CreateFiber SystemTimeToFileTime GetACP ConvertThreadToFiber RtlVirtualUnwind LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW SetEndOfFile WriteConsoleW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetStdHandle SetFilePointerEx HeapReAlloc GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineA MoveFileExW SetEnvironmentVariableW GetFullPathNameW SetConsoleCtrlHandler SystemTimeToTzSpecificLocalTime RemoveDirectoryW FindFirstFileExA FindFirstFileExW CreateDirectoryW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CreateMutexW GetModuleHandleW GetExitCodeProcess CreateProcessW Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess TerminateProcess UnmapViewOfFile GetCurrentProcess GetFileAttributesExW GetFileAttributesW GetModuleFileNameW FindResourceW LoadResource LockResource FreeResource SizeofResource QueueUserWorkItem GetCurrentThreadId ResetEvent CreateThread DeleteFileW WaitForMultipleObjects GetProcessHeap HeapAlloc HeapFree FlushFileBuffers GetSystemTime WideCharToMultiByte GetWindowsDirectoryW DeleteFileA lstrcatW OutputDebugStringW FormatMessageW MultiByteToWideChar OutputDebugStringA lstrcpynW GetCommandLineW GetFileSizeEx ConnectNamedPipe CreateNamedPipeA Sleep SetNamedPipeHandleState GetOverlappedResult CreateEventW WaitForSingleObject LocalAlloc SetEvent DisconnectNamedPipe PeekNamedPipe GetDriveTypeW DuplicateHandle FreeLibraryAndExitThread ExitThread ExitProcess RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx DecodePointer EncodePointer GetPrivateProfileStringW WritePrivateProfileStringW MoveFileW lstrcpyW GetFileSize CloseHandle CreateFileA GetLastError CreateFileW FindClose WriteFile lstrlenW FindNextFileW FindFirstFileW ReadFile lstrcmpW LocalFree ConvertFiberToThread InitializeCriticalSectionEx LCMapStringEx RaiseException RtlPcToFileHeader GetStringTypeW GetNativeSystemInfo WaitForSingleObjectEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryPerformanceFrequency QueryPerformanceCounter AreFileApisANSI GetFileInformationByHandle GetLocaleInfoEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive RtlUnwind

user32

DispatchMessageW MessageBoxW GetMessageW TranslateMessage wsprintfW ShowWindow GetUserObjectInformationW GetProcessWindowStation ExitWindowsEx

advapi32

RegQueryValueExA FreeSid RegCloseKey BuildTrusteeWithSidW DeleteAce GetNamedSecurityInfoW SetNamedSecurityInfoW AllocateAndInitializeSid EqualSid GetAce GetTokenInformation CryptGenRandom CryptReleaseContext ConvertStringSidToSidW GetUserNameW RegNotifyChangeKeyValue RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptDestroyHash CryptImportKey DeregisterEventSource RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl SetEntriesInAclW CopySid IsValidSid OpenProcessToken InitializeSecurityDescriptor

shell32

ShellExecuteExW

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance CoInitializeSecurity

oleaut32

SysFreeString VariantInit VariantClear SysAllocString VariantCopy SysStringLen VariantChangeType

wintrust

WinVerifyTrust

crypt32

CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CryptDecodeObjectEx CryptMsgClose CertOpenSystemStoreW CertFreeCertificateContext

iphlpapi

NotifyRouteChange2 CancelMibChangeNotify2

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpQueryHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

ws2_32

getsockopt setsockopt connect socket send htons ioctlsocket recv WSAStartup select WSACleanup getnameinfo getpeername WSAGetLastError freeaddrinfo getaddrinfo listen bind htonl ntohl WSAPoll ntohs getsockname WSASocketW WSAAccept shutdown WSARecv WSASetLastError closesocket WSASend WSAAddressToStringW sendto recvfrom getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr gethostbyname WSAStringToAddressW

userenv

GetAllUsersProfileDirectoryW

shlwapi

PathRemoveFileSpecW

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptGetProperty BCryptCreateHash

mswsock

AcceptEx GetAcceptExSockaddrs

version

VerQueryValueW

urlmon

URLDownloadToFileW

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

179KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

iphlpapi

setupapi

winhttp

ws2_32

userenv

shlwapi

bcrypt

mswsock

version

urlmon

generic