2026-08-04_ac35c415ba26f23aac1a964f5d10f601_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_ac35c415ba26f23aac1a964f5d10f601_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc
Size 11.2MB
Sample260804-gl741sdh94
SHA256 a151b07146e83790b015725badab5a9f4409a23dcd0a19a00b7f2d98c0bba18d
MD5 ac35c415ba26f23aac1a964f5d10f601
SHA1 c5d196fdefa5ec284d6df4f6b4748adfae7b546c
SHA512 d2ff7e7aabb237cca5ce571f7ca50bc3eab62635764d7d181e34c9fcca2e0362c6cf4254f8c24f720676e3accaa156f288fb393fa1c0769e1835a77a8e7be9fe
SSDEEP 196608:74qbDY6lPawstMt6Xhr9TvsQ62M4HFMwJEP7ZMwmFsT6p:7bA6nstMt6Xhr9TvtHKiETZzmFs
TLSH
T1F0C6BE1AA26400EED567C238C6C6E217E7B17C2313718BCB11A87A661F73EE15E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_ac35c415ba26f23aac1a964f5d10f601_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc

File Explorer

2026-08-04_ac35c415ba26f23aac1a964f5d10f601_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc

.exe 11.2MB

2026-08-04_ac35c415ba26f23aac1a964f5d10f601_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc

IMPHASH 1fbc2506955de03ac1da7bd2ec0fc790
SHA256 a151b07146e83790b015725badab5a9f4409a23dcd0a19a00b7f2d98c0bba18d
MD5 ac35c415ba26f23aac1a964f5d10f601
SHA1 c5d196fdefa5ec284d6df4f6b4748adfae7b546c
SHA512 d2ff7e7aabb237cca5ce571f7ca50bc3eab62635764d7d181e34c9fcca2e0362c6cf4254f8c24f720676e3accaa156f288fb393fa1c0769e1835a77a8e7be9fe
SSDEEP 196608:74qbDY6lPawstMt6Xhr9TvsQ62M4HFMwJEP7ZMwmFsT6p:7bA6nstMt6Xhr9TvtHKiETZzmFs
TLSH
T1F0C6BE1AA26400EED567C238C6C6E217E7B17C2313718BCB11A87A661F73EE15E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5116060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\streaming\win64\Release\streaming_client.pdb

kernel32

GlobalAlloc GlobalUnlock GlobalLock LocalAlloc LocalFree VerifyVersionInfoW MultiByteToWideChar RaiseException GetCurrentThread GetCurrentThreadId SetThreadPriority GetModuleHandleExW WideCharToMultiByte GetModuleFileNameW GetSystemDirectoryA GetCurrentProcessId Sleep SetLastError WriteFile MoveFileExW GetFullPathNameW DeleteFileW CreateFileA CreateDirectoryW VerSetConditionMask GlobalFree GetFileAttributesW FindFirstFileW FindClose CreateFileW OutputDebugStringA FormatMessageA GetCurrentProcess CreateEventA WaitForSingleObject ResetEvent SetEvent GetLastError LeaveCriticalSection EnterCriticalSection DeviceIoControl GetModuleHandleA OpenProcess GetExitCodeProcess CloseHandle FreeLibrary LoadLibraryA MoveFileExA GetProcAddress WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc SetStdHandle SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeZoneInformation HeapValidate HeapSize SetConsoleCtrlHandler ExitProcess GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent UnhandledExceptionFilter RtlCaptureContext RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW GetCPInfo LCMapStringEx DecodePointer EncodePointer GetStringTypeW InitOnceComplete InitOnceBeginInitialize GetTickCount64 SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime GetTimeFormatW GetDateFormatW SetFileTime SetFilePointer SetEndOfFile GetFileInformationByHandle GetFileAttributesExW GetDriveTypeW GetDiskFreeSpaceA FlushFileBuffers GetCurrentDirectoryW FindNextFileW GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA RtlVirtualUnwind GetStdHandle GetEnvironmentVariableW GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount InitializeCriticalSectionEx QueryPerformanceFrequency WaitForSingleObjectEx GetEnvironmentVariableA SleepEx GetFileSizeEx ReadFile GetSystemTime SystemTimeToFileTime IsDebuggerPresent TerminateProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW GlobalMemoryStatusEx VirtualAlloc VirtualFree GetModuleFileNameA GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetProcessAffinityMask DuplicateHandle TryEnterCriticalSection SwitchToThread CreateThread OpenThread GetExitCodeThread SetThreadAffinityMask SetUnhandledExceptionFilter LoadLibraryExW LoadLibraryW DebugBreak GetProcessHeaps SetProcessAffinityMask SetEnvironmentVariableW FindFirstFileExW

user32

EnumWindows GetWindowThreadProcessId GetDesktopWindow MessageBoxA GetWindowTextLengthA EmptyClipboard CloseClipboard OpenClipboard SetDlgItemTextA FlashWindowEx IsWindowVisible GetWindowRect SetClipboardData GetDlgItemInt SetDlgItemInt GetDlgItem EndDialog DialogBoxParamA SetWindowPos wsprintfA MessageBoxW GetProcessWindowStation GetUserObjectInformationW

advapi32

DeregisterEventSource RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey RegisterEventSourceW ReportEventW CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

shell32

CommandLineToArgvW

ole32

CLSIDFromString

ws2_32

getsockname WSAGetLastError ntohl htonl select __WSAFDIsSet gethostname WSAEnumNetworkEvents bind closesocket ioctlsocket htons recvfrom sendto setsockopt WSAEventSelect WSAIoctl WSASendMsg getaddrinfo freeaddrinfo getsockopt ntohs recv send WSASetLastError accept connect listen WSACloseEvent WSACreateEvent inet_ntop inet_pton getpeername WSAStartup WSACleanup socket

psapi

GetProcessMemoryInfo

winmm

timeEndPeriod timeBeginPeriod

sdl3_image

IMG_FreeAnimation IMG_Load_IO IMG_isSVG IMG_LoadAnimation_IO

bcrypt

BCryptGenRandom

crypt32

CryptStringToBinaryA CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.7MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

272KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

628KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_ac35c415ba26f23aac1a964f5d10f601_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

ws2_32

psapi

winmm

sdl3_image

bcrypt

crypt32

generic