2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 649KB
Sample260802-dzl7xstcmd
SHA256 cd92ea3b0110ad32503979c133686a98186fcc5fb63dcb477ab8bf9c397eb318
MD5 2618c353411b58d2b1fee0b897b181c4
SHA1 7c110d6c26e44820d623e954e0c577adfc583674
SHA512 095de706407b88a68f4d9fba0138b968de8e05e449439e287496145fe11cc8b01206b83027d7caef548dd5bb9d20c47efc0d7da2780de8373e868b92d74f05a1
SSDEEP 12288:aQ4qIOdLUFqhP3c3P9hUj4NSSILLt+njZlLEuZvJ7jrwRtAwye48z9mi+lfjK:r4w9UFqp3c3lhUj4Jst+njZg
TLSH
T1ECE47D56A39840FDE16BC03989465913F776BC1B03618AEF13D0856A3F5BAE05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 649KB

2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH fd9b1a41d1ffbea10ef0d5016be795b3
SHA256 cd92ea3b0110ad32503979c133686a98186fcc5fb63dcb477ab8bf9c397eb318
MD5 2618c353411b58d2b1fee0b897b181c4
SHA1 7c110d6c26e44820d623e954e0c577adfc583674
SHA512 095de706407b88a68f4d9fba0138b968de8e05e449439e287496145fe11cc8b01206b83027d7caef548dd5bb9d20c47efc0d7da2780de8373e868b92d74f05a1
SSDEEP 12288:aQ4qIOdLUFqhP3c3P9hUj4NSSILLt+njZlLEuZvJ7jrwRtAwye48z9mi+lfjK:r4w9UFqp3c3lhUj4Jst+njZg
TLSH
T1ECE47D56A39840FDE16BC03989465913F776BC1B03618AEF13D0856A3F5BAE05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

272284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_pton setsockopt WSAGetLastError send htons connect WSACleanup WSAStartup gethostname socket closesocket shutdown recv

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA GetUserNameA

shell32

SHCreateDirectoryExA SHGetFolderPathA ShellExecuteExA

user32

SendInput GetSystemMetrics GetDC ReleaseDC EnumDisplayDevicesA ShowWindow

gdi32

DeleteObject SelectObject StretchBlt SetStretchBltMode DeleteDC CreateCompatibleDC CreateCompatibleBitmap

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipImageRotateFlip GdipFree GdipAlloc GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToStream

ole32

CoInitializeEx CreateStreamOnHGlobal PropVariantClear CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

VariantClear VariantInit

mfplat

MFCreateMediaType MFCreateAttributes MFShutdown MFStartup

mf

MFCreateDeviceSource MFEnumDeviceSources

mfreadwrite

MFCreateSourceReaderFromMediaSource

crypt32

CryptUnprotectData

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA InternetReadFile

kernel32

FindNextFileW IsValidCodePage GetACP GetOEMCP HeapQueryInformation HeapSize HeapReAlloc OutputDebugStringW MultiByteToWideChar GetTimeZoneInformation SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FindFirstFileExW FlushFileBuffers LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapAlloc GetFileAttributesExW CreateProcessW HeapFree GetCommandLineW GetCommandLineA WriteFile WriteConsoleW GetModuleFileNameW GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc CreateFileW GetCurrentThreadId EncodePointer SetLastError RtlUnwindEx GetStdHandle CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA GetFileSizeEx GetLogicalDrives ReadFile SetFileAttributesA GetTempPathA CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject Sleep GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateProcessA OpenProcess GlobalMemoryStatusEx VirtualAlloc GetModuleFileNameA LocalFree CopyFileA GetComputerNameA WideCharToMultiByte GetConsoleWindow CreateToolhelp32Snapshot Process32First Process32Next GetEnvironmentVariableA FreeLibrary GetProcAddress LoadLibraryW WaitForSingleObjectEx SetEndOfFile GetExitCodeThread InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException RtlPcToFileHeader

Name

.text

Size

463KB

Virtual Size

463KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

ws2_32

advapi32

shell32

user32

gdi32

gdiplus

ole32

oleaut32

mfplat

mf

mfreadwrite

crypt32

wininet

kernel32

generic