2026-08-04_f42fd1c0c7a63aac03e5fb7a8999256e_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_f42fd1c0c7a63aac03e5fb7a8999256e_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.0MB
Sample260804-qrhwra1gqa
SHA256 3c574fe394c823018c8d1873584b81f79a4a390e0e1cad1983e4fc78bbe8ba82
MD5 f42fd1c0c7a63aac03e5fb7a8999256e
SHA1 0ad4e8ee099526ba2aa5e2517a72a02f4d2ea847
SHA512 c08e9750e70a7df490d4f22d2f4d091850c1d5d561fc5f7adb6a53394c0cfb7020a9f631b7eb9041dccff1e5c73b919711776bca1272df6a91b4f82ec30b4960
SSDEEP 49152:WGtlqslIU6i8VwASOzSc1i8W4ciyxSQ9fA/Kb+mZC+2tet/+RitrRD9WKOWd/iSv:2+E5xKyy3cF2OBGoAL9Uk
TLSH
T1CC168C59B7A400F8D5AAD138C5564723D6B2FC5627B097CB06A4A6BA0F73EE11F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_f42fd1c0c7a63aac03e5fb7a8999256e_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.0MB

2026-08-04_f42fd1c0c7a63aac03e5fb7a8999256e_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH d4e85cfe81431a51b215568b3aae4837
SHA256 3c574fe394c823018c8d1873584b81f79a4a390e0e1cad1983e4fc78bbe8ba82
MD5 f42fd1c0c7a63aac03e5fb7a8999256e
SHA1 0ad4e8ee099526ba2aa5e2517a72a02f4d2ea847
SHA512 c08e9750e70a7df490d4f22d2f4d091850c1d5d561fc5f7adb6a53394c0cfb7020a9f631b7eb9041dccff1e5c73b919711776bca1272df6a91b4f82ec30b4960
SSDEEP 49152:WGtlqslIU6i8VwASOzSc1i8W4ciyxSQ9fA/Kb+mZC+2tet/+RitrRD9WKOWd/iSv:2+E5xKyy3cF2OBGoAL9Uk
TLSH
T1CC168C59B7A400F8D5AAD138C5564723D6B2FC5627B097CB06A4A6BA0F73EE11F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

09:66:9b:89:bf:80:b8:17:c6:3a:50:7f:53:5d:6e:56:26:3d:20:b2:b6:01:42:3d:4e:39:a6:9e:6a:24:34:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 6, 2025

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

01:53:97:f6:21:77:85:ed:12:69:f9:4e:77:b5:87:74

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 30, 2024 - Dec 4, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2725112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

https://imgur.com/a/PiWvsB0

ws2_32

getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents shutdown getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr gethostbyname gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo socket recv listen htonl getsockname connect bind accept select __WSAFDIsSet WSAIoctl setsockopt htons WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect

wldap32

ord60 ord46 ord50 ord211 ord41 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord143

shlwapi

PathFindExtensionW

kernel32

CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc FlushFileBuffers GetFileSizeEx HeapAlloc HeapFree GetConsoleOutputCP GetModuleFileNameW SetConsoleCtrlHandler SetFilePointerEx FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW LoadLibraryExW RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter SetLastError CreateProcessW CloseHandle GetEnvironmentVariableW Sleep ExitProcess CreateThread K32GetMappedFileNameW GetCurrentProcess SetEvent WaitForSingleObjectEx GetLastError CreateEventW ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject CreateEventA MultiByteToWideChar QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA GetProcAddress LCMapStringW WideCharToMultiByte FormatMessageW MoveFileExA GetEnvironmentVariableA GetCurrentProcessId GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask VerifyVersionInfoW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA VirtualFree GetModuleHandleExW WriteFile GetModuleHandleW GetACP SwitchToFiber DeleteFiber CreateFiber GetSystemTime SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetSystemTimeAsFileTime TerminateProcess RtlVirtualUnwind ConvertFiberToThread ConvertThreadToFiber LoadLibraryW EncodePointer UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW HeapReAlloc SetStdHandle SetEndOfFile GetCurrentDirectoryW GetFullPathNameW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap DeleteFileW HeapSize WriteConsoleW LoadLibraryA RtlUnwind DecodePointer TryAcquireSRWLockExclusive

user32

TranslateMessage GetMessageW DispatchMessageW GetUserObjectInformationW GetProcessWindowStation GetCursorPos DestroyMenu TrackPopupMenuEx GetSystemMetrics SetForegroundWindow GetSubMenu LoadMenuW DefWindowProcW PostQuitMessage MessageBoxW DestroyWindow CreateWindowExW LoadIconW RegisterClassExW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource QueryServiceStatus ControlService OpenServiceW OpenSCManagerW CloseServiceHandle NotifyServiceStatusChangeW RegQueryInfoKeyW RegQueryValueExW RegCloseKey RegDeleteValueW RegOpenKeyExW

shell32

ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconW

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_f42fd1c0c7a63aac03e5fb7a8999256e_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

ws2_32

wldap32

shlwapi

kernel32

user32

advapi32

shell32

ole32

bcrypt

generic