2026-08-06_16a751d8798c18060b2078572a7dd086_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_16a751d8798c18060b2078572a7dd086_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.9MB
Sample260806-v2nbfazzdz
SHA256 251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882
MD5 16a751d8798c18060b2078572a7dd086
SHA1 0d7c940ba293b7b9a98aa41d5783c058ed320e37
SHA512 d0240ac74c823142ec1bfef4e856131afb0e90c02aac4dbfa9d9286ddcda24dbb0310b7715fe50249a6d0064e1cbd69c9ef5d2aaca5f1f90e5a8ecf2d1512b8b
SSDEEP 98304:JFG0GNHeVwRz8aGnkYc6ynef5zHRG6PgTraRDEvsIZVP:/LSHeVwRz8aGnkYJyeWrMEvlZ9
TLSH
T1F7168E87A2B801E8D0B7C1B885164913E6B27C6507719BDB02E4E5676F33AF21E3E735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_16a751d8798c18060b2078572a7dd086_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-06_16a751d8798c18060b2078572a7dd086_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.9MB

2026-08-06_16a751d8798c18060b2078572a7dd086_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH f178d459f55ef4c2ee17fa31a625c1c1
SHA256 251bd3ee3db24b3d0ac832281101cb6fe934aceb25b0db64a2971b96387a1882
MD5 16a751d8798c18060b2078572a7dd086
SHA1 0d7c940ba293b7b9a98aa41d5783c058ed320e37
SHA512 d0240ac74c823142ec1bfef4e856131afb0e90c02aac4dbfa9d9286ddcda24dbb0310b7715fe50249a6d0064e1cbd69c9ef5d2aaca5f1f90e5a8ecf2d1512b8b
SSDEEP 98304:JFG0GNHeVwRz8aGnkYc6ynef5zHRG6PgTraRDEvsIZVP:/LSHeVwRz8aGnkYJyeWrMEvlZ9
TLSH
T1F7168E87A2B801E8D0B7C1B885164913E6B27C6507719BDB02E4E5676F33AF21E3E735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2096116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Jenkins\jobs\LenovoStore_x64\workspace\bin\x64\SDLRelease\StoreDownloader.pdb

kernel32

InitializeCriticalSectionAndSpinCount FormatMessageW LocalFree SystemTimeToFileTime SetFileTime LocalFileTimeToFileTime ExitProcess lstrlenW lstrcmpW GlobalLock GlobalUnlock GetModuleHandleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader GetEnvironmentVariableW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetTickCount RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TryEnterCriticalSection AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile DeleteFileA HeapCompact UnlockFile LockFileEx CreateFileMappingW MapViewOfFile FlushFileBuffers GetCurrentDirectoryW VerifyVersionInfoW MulDiv LoadLibraryW GetProcAddress VerSetConditionMask GetACP TerminateProcess GetCurrentProcess ReadFile GetFileSize SetConsoleTextAttribute WriteConsoleW WideCharToMultiByte MultiByteToWideChar WTSGetActiveConsoleSessionId MoveFileExW GetPrivateProfileStringW GetPrivateProfileIntW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW lstrcpynW FindResourceExW VirtualQuery GetNativeSystemInfo GetLocalTime GetProcessId ProcessIdToSessionId CreateProcessW GetCurrentThreadId GetExitCodeProcess GetCurrentProcessId Sleep CreateMutexW WaitForSingleObject ReleaseMutex DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError CloseHandle DecodePointer OutputDebugStringW GetTempPathW WriteFile SetFilePointer SetFileAttributesW RemoveDirectoryW GetFileSizeEx GetFileAttributesW FindNextFileW FindFirstFileW GetTimeZoneInformation FileTimeToSystemTime GetSystemTime TerminateThread CreateThread GetSystemFirmwareTable GetLocaleInfoW GetProductInfo GetSystemInfo SignalObjectAndWait CreateEventW CreateFileA SleepEx WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA MoveFileExA LoadLibraryA GetModuleHandleA FreeLibrary GetSystemDirectoryA CreateEventA SetEvent GetSystemTimeAsFileTime GetCPInfo FindClose DeleteFileW CreateFileW CreateDirectoryW CompareStringEx LCMapStringEx EncodePointer WakeAllConditionVariable QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW SleepConditionVariableSRW RtlUnwind FormatMessageA TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx RaiseException IsDebuggerPresent GlobalAlloc lstrcmpiW FreeResource lstrcpyW ExpandEnvironmentStringsW UnhandledExceptionFilter GetStdHandle

user32

GetForegroundWindow GetWindowLongW SetWindowLongW FindWindowW GetWindowThreadProcessId SetCursor InflateRect IsIconic OffsetRect LoadCursorW GetDC ReleaseDC MonitorFromPoint GetMessageW TranslateMessage ShowWindow UnionRect DispatchMessageW EnumDisplaySettingsW SendMessageW PostMessageW CreateWindowExW DestroyWindow IsZoomed SetForegroundWindow SetFocus GetActiveWindow TrackPopupMenu GetKeyState SetCapture ReleaseCapture SetTimer KillTimer BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect ScreenToClient MapWindowPoints GetSysColor IntersectRect IsRectEmpty PtInRect GetParent GetWindow LoadImageW MonitorFromWindow GetMonitorInfoW wsprintfW DefWindowProcW CallWindowProcW RegisterClassExW AttachThreadInput GetWindowRect MessageBoxW GetCursorPos GetDesktopWindow CharNextW AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics IsWindowVisible GetClassInfoExW EnableWindow SetPropW GetPropW GetWindowLongPtrW SetWindowLongPtrW SetWindowRgn UpdateLayeredWindow CharPrevW DrawTextW FillRect SetRect LoadIconW SetWindowPos IsWindow PostQuitMessage GetFocus RegisterClassW DestroyIcon MapVirtualKeyExW GetKeyNameTextW GetKeyboardLayout GetGUIThreadInfo InvalidateRgn CreateAcceleratorTableW MoveWindow DrawTextA wsprintfA IsWindowEnabled GetWindowTextLengthW GetWindowTextW SetWindowTextW EqualRect UpdateWindow ClientToScreen GetCaretPos SetCaretPos ShowCaret HideCaret GetCaretBlinkTime CreateCaret EnableMenuItem GetIconInfo DrawIconEx

gdi32

CloseEnhMetaFile SelectObject SaveDC RestoreDC Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetStockObject EnumFontFamiliesExW DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDeviceCaps GetEnhMetaFileHeader GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CreateDIBSection CombineRgn CreateDCW CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetDIBits GetTextExtentPoint32W LineTo SelectClipRgn CreateEnhMetaFileW ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor GetObjectA MoveToEx TextOutW GdiFlush CreatePatternBrush GetTextExtentPointA GetBitmapBits SetBitmapBits PlayEnhMetaFile

advapi32

CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenServiceW OpenSCManagerW ControlService CloseServiceHandle RegGetValueW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegOpenCurrentUser RegCloseKey SetSecurityDescriptorDacl SetFileSecurityW RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CryptDestroyKey CryptImportKey CryptEncrypt CryptAcquireContextA RegOpenKeyExA RegQueryValueExA GetUserNameA RegSetValueExA RegQueryValueExW QueryServiceStatus StartServiceW

shell32

DragQueryFileW CommandLineToArgvW Shell_NotifyIconW ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoInitializeEx StringFromGUID2 CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CoInitializeSecurity DoDragDrop OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID OleLockRunning RegisterDragDrop CoSetProxyBlanket

oleaut32

VariantClear SafeArrayAccessData SysAllocString SysFreeString VariantInit SafeArrayUnaccessData

shlwapi

PathFindFileNameW PathIsDirectoryW PathRemoveFileSpecW PathFileExistsW

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

ws2_32

send WSAStartup gethostname gethostbyname WSACloseEvent WSACreateEvent ioctlsocket getpeername sendto recvfrom freeaddrinfo getsockopt recv listen htonl getsockname connect bind accept select getaddrinfo __WSAFDIsSet socket htons WSAIoctl setsockopt WSACleanup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAEnumNetworkEvents WSAEventSelect WSAResetEvent

wtsapi32

WTSQueryUserToken

comctl32

ord17 _TrackMouseEvent InitCommonControlsEx

gdiplus

GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipDeleteStringFormat GdipCloneStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDeleteFont GdipSetSmoothingMode GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateTexture GdipSetTextureTransform GdipLoadImageFromFile GdipGetImageThumbnail GdipFillEllipseI GdipTranslateWorldTransform GdipRotateWorldTransform GdipDeleteGraphics GdipCreateFromHDC GdipBitmapUnlockBits GdipBitmapLockBits GdipStringFormatGetGenericTypographic GdipImageGetFrameDimensionsCount GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipAddPathArc GdipAddPathLine GdipDeletePath GdipCreatePath GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipMeasureString GdipDrawString GdipImageGetFrameDimensionsList GdipRotateMatrix

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dbghelp

MakeSureDirectoryPathExists

sensapi

IsNetworkAlive

iphlpapi

GetAdaptersAddresses

crypt32

CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptQueryObject PFXImportCertStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCreateCertificateChainEngine CertFreeCertificateChain CertGetCertificateChain CryptDecodeObjectEx CertFreeCertificateChainEngine CryptStringToBinaryA CertCloseStore CertOpenStore

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41

winhttp

WinHttpSetStatusCallback WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpSetCredentials WinHttpQueryAuthSchemes WinHttpReceiveResponse WinHttpQueryHeaders WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpGetProxyForUrl

generic

count=22, id=259, version=30795,

count=220, id=261, version=30795,

count=3, productName=Unmarked objects (old),

count=6, id=260, version=27031,

count=7, id=253, version=33808,

count=10, id=259, version=33808,

count=19, id=260, version=33808,

count=1, id=260, version=34123,

count=1, id=263, version=30795,

count=3, id=265, version=34123,

count=6, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=127, id=260, version=33523,

count=105, id=261, version=33808,

count=46, id=260, version=30795,

count=1, id=262, version=30795,

count=41, id=257, version=30795,

count=644, id=1, productName=Unmarked objects,

count=81, id=261, version=34123,

count=1, id=255, version=34123,

count=1, id=151,

count=1, id=258, version=34123,