2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
Size 6.0MB
Sample260803-dctcqa1vd1
SHA256 85aefa7ed23adba83bfa766594bc5e7abebf3a3f4e4d92bcc330343a20807387
MD5 2eb604fdaebda468605d217057c4d4f4
SHA1 5dbb9fb69f5fce52b835968c99a3e027346999f1
SHA512 d405c1811351dce0b9ec5b9c630aa4089a990ca68053d343f69c5062d4dacb8ef5577777917db14e3ef828e360d44c0c7bf0fbecd3e66a5debeba1af5a6b281d
SSDEEP 98304:ul+0x9FjO5095ZqNcxfH64NWg/29z4V4wFRKIh:2hx9M509vqNcxfH64Ix9zMHDKI
TLSH
T12556AE66A6A450ECD577C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

File Explorer

2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

.exe 6.0MB

2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

IMPHASH 7df38e7ed5c3951c98bd977e3eb4cc23
SHA256 85aefa7ed23adba83bfa766594bc5e7abebf3a3f4e4d92bcc330343a20807387
MD5 2eb604fdaebda468605d217057c4d4f4
SHA1 5dbb9fb69f5fce52b835968c99a3e027346999f1
SHA512 d405c1811351dce0b9ec5b9c630aa4089a990ca68053d343f69c5062d4dacb8ef5577777917db14e3ef828e360d44c0c7bf0fbecd3e66a5debeba1af5a6b281d
SSDEEP 98304:ul+0x9FjO5095ZqNcxfH64NWg/29z4V4wFRKIh:2hx9M509vqNcxfH64Ix9zMHDKI
TLSH
T12556AE66A6A450ECD577C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2006376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\steamexe\win64\Release\steamexe.pdb

kernel32

GetExitCodeProcess GetCurrentProcess WaitForSingleObject SystemTimeToFileTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe WriteFile IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ExitProcess RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GlobalAlloc SizeofResource LockResource OpenProcess LoadResource GetModuleFileNameW GetProductInfo GetVersionExA SetStdHandle GetFullPathNameW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress GetCurrentThreadId Sleep CreateSymbolicLinkW DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW InitializeSListHead SleepConditionVariableSRW GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SetProcessAffinityMask GetProcessHeaps DebugBreak SetUnhandledExceptionFilter GetProcessAffinityMask GetSystemInfo GetLastError ProcessIdToSessionId CreateProcessW OutputDebugStringW SetCurrentDirectoryW SetEnvironmentVariableW SetThreadAffinityMask TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId OpenEventA SetEvent SetErrorMode CloseHandle ResumeThread SuspendThread GetExitCodeThread TerminateThread SetThreadPriority OpenThread RemoveDirectoryA GetFileAttributesA MultiByteToWideChar LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetFileType GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetDateFormatW GetTimeFormatW GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent CreateEventA WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent TerminateProcess GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree RtlCaptureStackBackTrace GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread

user32

GetDC CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW DestroyWindow GetWindowThreadProcessId EnumWindows GetUserObjectInformationW IsWindowVisible ReleaseDC GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer SetTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow MsgWaitForMultipleObjects SetWindowPos MoveWindow GetProcessWindowStation AllowSetForegroundWindow MessageBoxA ShowWindow

gdi32

RemoveFontMemResourceEx TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegSetValueExW RegQueryValueExW ReportEventW

shell32

ord680 SHGetFileInfoW CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

comctl32

InitCommonControlsEx

psapi

GetModuleInformation GetProcessMemoryInfo GetModuleFileNameExW

version

VerQueryValueW

crypt32

CertOpenStore CertGetCertificateChain CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

send htonl htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError recv WSARecvFrom WSASend WSASendTo WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup connect bind WSAIoctl setsockopt getsockname WSARecv ioctlsocket

wsock32

ord1142

bcrypt

BCryptGenRandom

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_2eb604fdaebda468605d217057c4d4f4_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic