2026-08-03_4ccc436168db4d5f371f2a78b1d3e2ab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_4ccc436168db4d5f371f2a78b1d3e2ab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 11.2MB
Sample260804-n8sfeazanf
SHA256 0b47c71f018c7b03cf2534710acaf73873769256cdec228b1c09d0731725753d
MD5 4ccc436168db4d5f371f2a78b1d3e2ab
SHA1 c73cb3ac4257d54508f435b024a8d5061f291489
SHA512 e08fd20dc7e4bed775ccf1af58f838ed0b8c46d9cc6ea7b4d9ddff25d7a86c8f3383ef78564e6bcd8684eb1250bbb14994752037f9c27be58939b087135f347d
SSDEEP 196608:91YYTp4hVl8oZxVy7cn3GExK2cYSGl9HU+fWui6bSsahgMq5maEASm:91Dp6txVy7c3BDpfl9V06OXhDqQaE
TLSH
T19CC602EAB19422ACC0278038C523ED1AF1B3741D0B6596EB73D677903FAB5F09676B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_4ccc436168db4d5f371f2a78b1d3e2ab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-03_4ccc436168db4d5f371f2a78b1d3e2ab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 11.2MB

2026-08-03_4ccc436168db4d5f371f2a78b1d3e2ab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH e7391a3f3e9c6e4e8cee5f4aed348b83
SHA256 0b47c71f018c7b03cf2534710acaf73873769256cdec228b1c09d0731725753d
MD5 4ccc436168db4d5f371f2a78b1d3e2ab
SHA1 c73cb3ac4257d54508f435b024a8d5061f291489
SHA512 e08fd20dc7e4bed775ccf1af58f838ed0b8c46d9cc6ea7b4d9ddff25d7a86c8f3383ef78564e6bcd8684eb1250bbb14994752037f9c27be58939b087135f347d
SSDEEP 196608:91YYTp4hVl8oZxVy7cn3GExK2cYSGl9HU+fWui6bSsahgMq5maEASm:91Dp6txVy7c3BDpfl9V06OXhDqQaE
TLSH
T19CC602EAB19422ACC0278038C523ED1AF1B3741D0B6596EB73D677903FAB5F09676B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5975640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SleepEx GetSystemTimeAsFileTime LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

SetCapture GetUserObjectInformationW GetProcessWindowStation GetUserObjectInformationW

msvcp140

_Query_perf_frequency

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

xinput1_4

ord4

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

ws2_32

WSAStartup

crypt32

CertFreeCertificateChain

wldap32

ord35

normaliz

IdnToAscii

rpcrt4

UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

sinf

api-ms-win-crt-time-l1-1-0

_gmtime64

advapi32

CryptImportKey

shell32

ShellExecuteA

wtsapi32

WTSSendMessageW

Name

.text

Size

617KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

772KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

263KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_4ccc436168db4d5f371f2a78b1d3e2ab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

msvcp140

imm32

d3dcompiler_47

xinput1_4

d3d11

dwmapi

ws2_32

crypt32

wldap32

normaliz

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

advapi32

shell32

wtsapi32

generic