2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 1.1MB
Sample260808-3dblqswdqa
SHA256 aeb937a519457e4f1eee95165ee1c33bacb60d1d236b188b5850d432cb15db90
MD5 8af98a6621d0b4f49e8bf0e6c138e6a5
SHA1 a33adef6dcd64a6f6c610e3502b30668305e3f04
SHA512 5189ddeafe5f690d5beaccf66af26de6bb10003c3e0eb100db546445f0ae5f9dc738510606ce679be833c4788c910005cf0b993dcade5323c92ee423b8dbbc1c
SSDEEP 12288:2rq3gCucGs9QxhjaIuEtGKeCbPz1f2X7sXgYbuMeSK7LoyNS:scGhjaId0KeCb9YanTK7LoyN
TLSH
T1F0358E0255FB85B9CC67B03D5BA7800DB231A8035A05EFE5BE9C83288F5B47859F7B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.1MB

2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 5609a9aee341e22156f93ca431f62893
SHA256 aeb937a519457e4f1eee95165ee1c33bacb60d1d236b188b5850d432cb15db90
MD5 8af98a6621d0b4f49e8bf0e6c138e6a5
SHA1 a33adef6dcd64a6f6c610e3502b30668305e3f04
SHA512 5189ddeafe5f690d5beaccf66af26de6bb10003c3e0eb100db546445f0ae5f9dc738510606ce679be833c4788c910005cf0b993dcade5323c92ee423b8dbbc1c
SSDEEP 12288:2rq3gCucGs9QxhjaIuEtGKeCbPz1f2X7sXgYbuMeSK7LoyNS:scGhjaId0KeCb9YanTK7LoyN
TLSH
T1F0358E0255FB85B9CC67B03D5BA7800DB231A8035A05EFE5BE9C83288F5B47859F7B85
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetMessageA LoadIconA LoadCursorA FindWindowA SetWindowLongPtrA GetWindowLongPtrA FillRect ScreenToClient MessageBoxA GetClientRect GetWindowTextLengthA InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextA GetSystemMetrics KillTimer SetTimer MoveWindow ShowWindow CreateWindowExA RegisterClassExA CallWindowProcA PostQuitMessage DefWindowProcA PostMessageA SendMessageA DispatchMessageA TranslateMessage TrackMouseEvent

gdi32

MoveToEx SetTextColor SetBkMode SetBkColor SelectObject RoundRect LineTo RemoveFontMemResourceEx AddFontMemResourceEx DeleteObject CreateSolidBrush CreatePen CreateFontA

shell32

SHGetFolderPathA ShellExecuteExA

comctl32

InitCommonControlsEx

advapi32

CheckTokenMembership AllocateAndInitializeSid FreeSid

kernel32

HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleOutputCP SetStdHandle GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetConsoleMode GetLocaleInfoW LCMapStringW HeapSize CreateFileW WriteConsoleW SetEndOfFile FlushFileBuffers CreateDirectoryA CreateFileA DeleteFileA GetDiskFreeSpaceExA ReadFile RemoveDirectoryA WriteFile IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError CreatePipe WaitForSingleObject Sleep GetCurrentProcess ExitProcess GetExitCodeProcess CreateProcessA OpenProcess GetLocalTime FreeResource GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource QueryFullProcessImageNameA FindResourceA K32EnumProcesses CreateToolhelp32Snapshot Process32First Process32Next GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive RtlUnwind EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter GetSystemTimePreciseAsFileTime WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent TerminateProcess GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree HeapAlloc VirtualProtect LoadLibraryExW

Name

.text

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

821KB

Virtual Size

821KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

user32

gdi32

shell32

comctl32

advapi32

kernel32

generic