2026-08-07_8e8c50b2f5e41c91aa2bfa89567abfbf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_8e8c50b2f5e41c91aa2bfa89567abfbf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
Size 520KB
Sample260808-bb8d5ser5y
SHA256 4618b77958c38e6fec65ce801cd3828813fd00b0bf778ffdd46812cfa5046d4f
MD5 8e8c50b2f5e41c91aa2bfa89567abfbf
SHA1 19c2d067429ead65b05bb2be42d3466beed25acc
SHA512 63f89dd0c2e65aa0c420f430b66cc65f3577b79a39f8807c646e6c2f7403ef7290f54c3ff0e1fca94ac54e9f0221c9e013aed704793ba2a9971c43c0050662f3
SSDEEP 6144:U5OoFoq8B648g5xHFc8i0ITaBGZkq7C9j6576f8byp2zqrVJdDeHr/+BgRs3yl:5HFc8i0ITOqPXba5xTez+i2c
TLSH
T15AB46C99E66803F5D0ABC178C9434506E7727C9647B19ADF03E04AB24F276E19E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-07_8e8c50b2f5e41c91aa2bfa89567abfbf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-07_8e8c50b2f5e41c91aa2bfa89567abfbf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

.exe 520KB

2026-08-07_8e8c50b2f5e41c91aa2bfa89567abfbf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 26178c701f41279c8dba89a801ca9d04
SHA256 4618b77958c38e6fec65ce801cd3828813fd00b0bf778ffdd46812cfa5046d4f
MD5 8e8c50b2f5e41c91aa2bfa89567abfbf
SHA1 19c2d067429ead65b05bb2be42d3466beed25acc
SHA512 63f89dd0c2e65aa0c420f430b66cc65f3577b79a39f8807c646e6c2f7403ef7290f54c3ff0e1fca94ac54e9f0221c9e013aed704793ba2a9971c43c0050662f3
SSDEEP 6144:U5OoFoq8B648g5xHFc8i0ITaBGZkq7C9j6576f8byp2zqrVJdDeHr/+BgRs3yl:5HFc8i0ITOqPXba5xTez+i2c
TLSH
T15AB46C99E66803F5D0ABC178C9434506E7727C9647B19ADF03E04AB24F276E19E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8a:c9:56:77:09:57:6a:94:fe:35:52:f1:42:3b:f2:12:ac:f7:0a:07:bc:ca:97:0a:7a:5c:2c:d4:59:b4:fa:ce

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SFB,OU=Nexis,O=Taly,L=Fairway,ST=AK,C=US

Chains

Aug 6, 2026

CN=SFB,OU=Nexis,O=Taly,L=Fairway,ST=AK,C=US

Minor OS version

Major OS version

Entry point

198224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Work\New folder\chup\x64\Release\chup.pdb

kernel32

GetModuleHandleA GlobalLock GlobalUnlock GetTempPathA CreateDirectoryA GetDriveTypeA GetNativeSystemInfo GetSystemInfo GetLogicalDriveStringsA GetProcAddress GlobalMemoryStatusEx GetModuleHandleW GetDiskFreeSpaceExA GetComputerNameA WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc CreatePipe GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileSizeEx CloseHandle GetLastError ReleaseMutex GetConsoleMode ReadFile GetExitCodeProcess WaitForSingleObject GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW CreateProcessW DuplicateHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread ReadConsoleW CreateMutexA QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive Sleep WaitForSingleObjectEx GetExitCodeThread SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle GetTempPathW AreFileApisANSI CopyFileW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LocalFree GetLocaleInfoEx InitializeCriticalSectionEx GetSystemTimeAsFileTime EncodePointer DecodePointer WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread RtlUnwind

user32

EnumDisplayDevicesA SetWindowsHookExA UnhookWindowsHookEx ToUnicode GetMessageA DispatchMessageA CallNextHookEx OpenClipboard CloseClipboard RegisterClassA DefWindowProcA CreateWindowExA TranslateMessage GetClipboardData DestroyWindow PostQuitMessage AddClipboardFormatListener RemoveClipboardFormatListener GetKeyboardState

advapi32

GetUserNameA

libcurl

curl_global_cleanup curl_easy_init curl_easy_cleanup curl_easy_setopt curl_global_init curl_easy_getinfo curl_easy_perform curl_easy_strerror

zlib1

deflateEnd deflate inflate inflateEnd deflateInit2_ inflateInit2_

bcrypt

BCryptGenRandom

ws2_32

WSAStartup getaddrinfo WSACleanup WSAGetLastError htons inet_ntop closesocket recv connect socket send inet_pton htonl shutdown freeaddrinfo

iphlpapi

GetAdaptersAddresses

Name

.text

Size

375KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_8e8c50b2f5e41c91aa2bfa89567abfbf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

PE Signature issue

kernel32

user32

advapi32

libcurl

zlib1

bcrypt

ws2_32

iphlpapi

generic