2026-08-04_24f5f4aefea6c7002d51292c0dfe3c1a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_24f5f4aefea6c7002d51292c0dfe3c1a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar
Size 18.7MB
Sample260804-285bvszzc1
SHA256 0872f21d2b6bc83174349f456a5ae2bdb3244a93e6b15f61b80282d53dcbc367
MD5 24f5f4aefea6c7002d51292c0dfe3c1a
SHA1 2a884b3512e11c217ce9c3d2d1de8056aed01230
SHA512 6267cb2321e9c8616c0c4fe76dd47d1815bc138a2fd3cdc06149099b4d0d75adf1779fafaf47255bdee50bd71e31a6beb96386233235d265637c0a0bba05cfbe
SSDEEP 393216:jztnkAJlP6dG20XE6oqGzRrrnG8kLs3I4KPnQYRr6OPML04rqcV33gt5rPIV:jztnYqXLGYLsYhQu4uI33gt5rP
TLSH
T17517F14B739501F4C1A3E278C8431513E6B17815533226EF7EEC46692FB37E0A6BAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_24f5f4aefea6c7002d51292c0dfe3c1a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

File Explorer

2026-08-04_24f5f4aefea6c7002d51292c0dfe3c1a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

.exe 18.7MB

2026-08-04_24f5f4aefea6c7002d51292c0dfe3c1a_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

IMPHASH e8ddc69121b5fc1527b153effcb60013
SHA256 0872f21d2b6bc83174349f456a5ae2bdb3244a93e6b15f61b80282d53dcbc367
MD5 24f5f4aefea6c7002d51292c0dfe3c1a
SHA1 2a884b3512e11c217ce9c3d2d1de8056aed01230
SHA512 6267cb2321e9c8616c0c4fe76dd47d1815bc138a2fd3cdc06149099b4d0d75adf1779fafaf47255bdee50bd71e31a6beb96386233235d265637c0a0bba05cfbe
SSDEEP 393216:jztnkAJlP6dG20XE6oqGzRrrnG8kLs3I4KPnQYRr6OPML04rqcV33gt5rPIV:jztnYqXLGYLsYhQu4uI33gt5rP
TLSH
T17517F14B739501F4C1A3E278C8431513E6B17815533226EF7EEC46692FB37E0A6BAB52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4651768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Salah\new\salah4.4.1\x64\ReleaseCodex\Vn_Hax4.3.0.pdb

ws2_32

shutdown getnameinfo WSAGetLastError gethostname sendto recvfrom freeaddrinfo getaddrinfo ioctlsocket listen htonl ntohl socket send recv closesocket accept WSACleanup WSAStartup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSASetLastError select __WSAFDIsSet inet_pton

wldap32

ord30 ord32 ord143 ord200 ord79 ord35 ord33 ord27 ord26 ord22 ord41 ord301 ord50 ord45 ord60 ord211 ord46

crypt32

CertEnumCertificatesInStore CertAddCertificateContextToStore CertFreeCertificateContext CertCloseStore CertOpenStore CryptStringToBinaryA CertFindCertificateInStore CertGetNameStringA CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject

api-ms-win-core-heap-l1-1-0

HeapReAlloc GetProcessHeap HeapDestroy HeapFree HeapSize HeapAlloc

api-ms-win-core-synch-l1-1-0

WaitForSingleObject CreateMutexW InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SleepEx WaitForSingleObjectEx InitializeCriticalSectionEx

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-file-l1-1-0

GetFileAttributesExW DeleteFileW GetFileAttributesW GetFileSizeEx GetDriveTypeW CreateFileW CreateFileA DeleteFileA GetFileType SetEndOfFile FindClose FindFirstFileW FlushFileBuffers FindNextFileW ReadFile WriteFile SetFilePointerEx

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe WaitNamedPipeW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

CreateThread GetStartupInfoW GetCurrentProcessId GetExitCodeProcess CreateProcessW GetCurrentThreadId TlsAlloc TlsGetValue TlsFree TlsSetValue OpenProcessToken ExitProcess GetCurrentProcess ExitThread TerminateProcess

api-ms-win-core-registry-l1-1-0

RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegQueryValueExA RegCloseKey RegGetValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA GetModuleFileNameA GetModuleHandleExW FreeLibrary SizeofResource FreeLibraryAndExitThread LockResource LoadResource GetModuleFileNameW GetProcAddress GetModuleHandleW LoadLibraryExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar CompareStringW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics GetMonitorInfoW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemDirectoryA GetTickCount64 GetSystemInfo GetSystemTimeAsFileTime GetSystemTime

api-ms-win-core-memory-l1-1-0

VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery VirtualAlloc VirtualProtectEx WriteProcessMemory VirtualQueryEx ReadProcessMemory

api-ms-win-core-heap-l2-1-0

GlobalAlloc LocalFree GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA FindResourceW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute GetConsoleScreenBufferInfo

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW ExpandEnvironmentStringsA GetStdHandle GetCommandLineA GetCommandLineW SetStdHandle GetEnvironmentVariableA

api-ms-win-core-com-l1-1-0

CreateStreamOnHGlobal

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-kernel32-legacy-l1-1-0

CopyFileA

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-security-base-l1-1-0

CopySid IsValidSid GetTokenInformation GetLengthSid

api-ms-win-core-console-l1-1-0

SetConsoleMode ReadConsoleA AllocConsole WriteConsoleW GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler ReadConsoleW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

bcrypt

BCryptGenRandom

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW IsValidLocale GetACP FormatMessageW LCMapStringW FormatMessageA GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP

api-ms-win-core-kernel32-legacy-l1-1-2

VerifyVersionInfoA

api-ms-win-security-cryptoapi-l1-1-0

CryptEnumProvidersW CryptSignHashW CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext RtlUnwind RtlPcToFileHeader RtlUnwindEx

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW ReportEventW DeregisterEventSource

api-ms-win-core-fibers-l2-1-0

ConvertFiberToThread DeleteFiber SwitchToFiber

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime FileTimeToSystemTime

kernel32

CompareStringEx GetCPInfo OutputDebugStringW RaiseException GetCurrentDirectoryW GetLocaleInfoEx GetExitCodeThread WakeConditionVariable SleepConditionVariableSRW CreateDirectoryW TryAcquireSRWLockExclusive EncodePointer InitOnceBeginInitialize InitOnceComplete GetStringTypeW GetFileInformationByHandleEx CreateFiber ConvertThreadToFiber ReleaseSRWLockExclusive AcquireSRWLockExclusive AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle LCMapStringEx FindFirstFileExW WakeAllConditionVariable

user32

GetAsyncKeyState UnregisterClassW GetWindowTextW IsIconic GetAncestor UpdateWindow GetClientRect MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetKeyNameTextA MapVirtualKeyA SetWindowLongW GetClassNameW SetWindowPos SetWindowDisplayAffinity FindWindowExW DestroyWindow CreateWindowExW GetClassNameA DispatchMessageW PeekMessageW LoadCursorW GetWindowTextA SendInput LoadIconW FindWindowW PrintWindow PostQuitMessage GetDesktopWindow SetForegroundWindow PostMessageW GetKeyboardLayout LoadKeyboardLayoutW ActivateKeyboardLayout GetKeyState GetDC ScreenToClient BringWindowToTop GetCapture IsChild GetForegroundWindow CreateWindowExA SetCapture EnumWindows SetCursor ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetCursorInfo TranslateMessage GetWindowThreadProcessId DefWindowProcW GetWindowRect SetLayeredWindowAttributes IsWindowVisible MonitorFromWindow EnumChildWindows GetWindowLongW RegisterClassExW ShowWindow IsWindow ClientToScreen

shell32

ShellExecuteExW ShellExecuteExA ShellExecuteA ShellExecuteW

shlwapi

PathFileExistsW ord213 ord214 ord184

gdi32

DeleteDC DeleteObject GetObjectW CreateCompatibleDC BitBlt SelectObject CreateCompatibleBitmap

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToStream GdipCreateBitmapFromScan0 GdipSaveImageToFile GdiplusStartup GdiplusShutdown

urlmon

URLDownloadToFileW

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory D3DXCreateFontW

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

wininet

InternetReadFile HttpQueryInfoA InternetOpenUrlA InternetCloseHandle InternetOpenA InternetSetOptionA

userenv

UnloadUserProfile

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsFree FlsGetValue FlsSetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

generic

count=29, id=259, version=30795,

count=223, id=261, version=30795,

count=6, id=253, version=33808,

count=19, id=260, version=33808,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=1, id=263, version=30795,

count=32, id=260, version=30795,

count=12, id=259, version=33808,

count=115, id=261, version=33808,

count=100, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=458, id=1, productName=Unmarked objects,

count=31, id=257, version=30795,

count=23, productName=Unmarked objects (old),

count=668, id=260, productName=VS2019 v16.5.5 build 28614, version=28614,

count=1, id=259, productName=VS2019 v16.5.5 build 28614, version=28614,

count=33, id=261, productName=VS2019 v16.5.5 build 28614, version=28614,

count=46, id=265, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,