2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 4.2MB
Sample260804-gd43dsdg65
SHA256 84ad51909e14d371838f5b8af28a47e6f760f30ef22fbe1fb03403f940a5715e
MD5 b9262069a456941413d1a33ead519a73
SHA1 2d25744670075aa2f2a68f3af04af49b7ee656fb
SHA512 3c4c1876151d9d877cc1bd9488d7ec53ae3d74fd8573175f62ff8a3e6f6ac4d3de43b755973d4bbceeb5e22981cb27ea8f189c15e009da6b1494e77f135ea108
SSDEEP 98304:+++LHz1i1oYJvJC8q2VhkbimwslgJTIZ5Bgp:J+z1i1oYJvJCjYhWimwsT6p
TLSH
T190269E16665901FCD5B7D138C6CA5627E7B17C1603B18BCB02E4BA661F33AE26E3E341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.2MB

2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 3f4b1e71518846c3ef9fb98f74128737
SHA256 84ad51909e14d371838f5b8af28a47e6f760f30ef22fbe1fb03403f940a5715e
MD5 b9262069a456941413d1a33ead519a73
SHA1 2d25744670075aa2f2a68f3af04af49b7ee656fb
SHA512 3c4c1876151d9d877cc1bd9488d7ec53ae3d74fd8573175f62ff8a3e6f6ac4d3de43b755973d4bbceeb5e22981cb27ea8f189c15e009da6b1494e77f135ea108
SSDEEP 98304:+++LHz1i1oYJvJC8q2VhkbimwslgJTIZ5Bgp:J+z1i1oYJvJCjYhWimwsT6p
TLSH
T190269E16665901FCD5B7D138C6CA5627E7B17C1603B18BCB02E4BA661F33AE26E3E341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2379100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\steamUI\gamestream\secure_desktop_capture\win64\Release\secure_desktop_capture.pdb

kernel32

GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalAlloc LocalFree MultiByteToWideChar SetLastError OutputDebugStringA WriteConsoleW FreeEnvironmentStringsW GetModuleHandleA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetFilePointerEx SetStdHandle LCMapStringW CompareStringW HeapValidate HeapSize SetConsoleCtrlHandler GetModuleHandleExW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe IsProcessorFeaturePresent UnhandledExceptionFilter RtlCaptureContext GetModuleFileNameW FreeLibrary GetCurrentProcessId GetEnvironmentStringsW Sleep WriteFile GetFullPathNameW FindFirstFileW FindClose CreateFileW Process32Next Process32First CreateToolhelp32Snapshot CreateFileMappingA UnmapViewOfFile MapViewOfFile OpenProcess GetCurrentProcess CreateEventA WaitForSingleObject ResetEvent SetEvent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader InitializeSListHead GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLastError CloseHandle LeaveCriticalSection ExitProcess EnterCriticalSection SetEndOfFile ReadFile GetFileSizeEx GetFileInformationByHandle GetCurrentDirectoryW FindNextFileW WideCharToMultiByte RtlVirtualUnwind InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetEnvironmentVariableW GetFileType GetModuleHandleW DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime IsDebuggerPresent TerminateProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW GlobalMemoryStatusEx VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameA GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation QueryPerformanceFrequency DuplicateHandle RaiseException TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread GetExitCodeThread SetUnhandledExceptionFilter LoadLibraryExA LoadLibraryExW LoadLibraryW DebugBreak GetProcessHeaps SetEnvironmentVariableW FindFirstFileExW FlushFileBuffers GetDriveTypeW RtlUnwind

user32

SetDlgItemInt GetDlgItem EndDialog SetDlgItemTextA CloseClipboard SetClipboardData EmptyClipboard GetDesktopWindow CloseDesktop GetDlgItemInt OpenClipboard OpenDesktopA GetWindowTextLengthA DialogBoxParamA GetWindowThreadProcessId EnumWindows GetShellWindow GetWindowRect IsWindowVisible ReleaseDC GetDC GetCursorInfo LoadCursorA GetCursorPos MessageBoxA GetSystemMetrics SendInput GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfA SetWindowPos

gdi32

GdiFlush SetBrushOrgEx CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC BitBlt

advapi32

RegSetValueExA RegisterEventSourceW DeregisterEventSource OpenProcessToken AddAccessAllowedAce RegDeleteTreeA ReportEventW RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid CreateWellKnownSid CopySid

shell32

CommandLineToArgvW

psapi

GetProcessMemoryInfo

bcrypt

BCryptGenRandom

ws2_32

WSASetLastError recv closesocket send WSACleanup WSAGetLastError

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

766KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_b9262069a456941413d1a33ead519a73_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

psapi

bcrypt

ws2_32

generic