2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

General

Target
2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar
Size 16.6MB
Sample260808-a5p9zseq3w
SHA256 ac05ff0d5b8452241bcaead9bd075679e91401c3b2cbda6397f8a496143bfef0
MD5 b1ab588dbdac31cb9c4ba589d478e558
SHA1 30c7c3f5034246a36d3cf826217c1ab47181982d
SHA512 97a23c1175d23538eeeadc54fe7a4c6201af47f41dcdcde885c60138e4c1bf3d8dd489af1c8dcf25aaf048b951b1ae3521280ddf81e5fa1fe229fe8b4323cc39
SSDEEP 393216:G61iJHJzTWe5/QlMbvL61iJHJzTWe5/QZg2UllSe:4JiuLhJiZpU3S
TLSH
T1CC071286B9909C12D5197A3883FE44C1E3F32D820F60854F6FD9B6421E5FBD89DB9683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

File Explorer

2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

.exe 16.6MB

2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

IMPHASH 3a4efb6213dac1e8d91059fd1741ae01
SHA256 ac05ff0d5b8452241bcaead9bd075679e91401c3b2cbda6397f8a496143bfef0
MD5 b1ab588dbdac31cb9c4ba589d478e558
SHA1 30c7c3f5034246a36d3cf826217c1ab47181982d
SHA512 97a23c1175d23538eeeadc54fe7a4c6201af47f41dcdcde885c60138e4c1bf3d8dd489af1c8dcf25aaf048b951b1ae3521280ddf81e5fa1fe229fe8b4323cc39
SSDEEP 393216:G61iJHJzTWe5/QlMbvL61iJHJzTWe5/QZg2UllSe:4JiuLhJiZpU3S
TLSH
T1CC071286B9909C12D5197A3883FE44C1E3F32D820F60854F6FD9B6421E5FBD89DB9683
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateDirectoryW ReadFile SizeofResource Process32First WriteFile TerminateProcess GetModuleFileNameW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentDirectoryA OpenProcess CreateToolhelp32Snapshot lstrcatW LockResource DeleteFileW Process32Next CloseHandle LoadResource FindResourceW GetFileSize CreateProcessW lstrcpyW lstrcmpiA WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess GetModuleHandleExW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers

user32

wsprintfW MessageBoxA

shell32

SHGetFolderPathW

Name

.text

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16.5MB

Virtual Size

16.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

kernel32

user32

shell32

generic