2026-08-09_a3ef5758c6fb624a03e4913c4059a203_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_a3ef5758c6fb624a03e4913c4059a203_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 5.9MB
Sample260809-hcea1ssdpe
SHA256 61a9274cb8fac69b496ab639f0eed19d2134ffe6dd25cbefcbb7427bac354ccd
MD5 a3ef5758c6fb624a03e4913c4059a203
SHA1 34059bb7278b0bb3888dad3ca56ea5194c107440
SHA512 146ca95c25c5525ffb19432fe7237e1dc30281904886e6721c6b7dd6afdc2d9d984631bb0e5d4008e4eac9439fa8b8905696334710bda28206fb12a6c36222ea
SSDEEP 49152:y+VwASOMGtlq1gIU6i5IojJWvVCi/rYeOaTiLBszmWUekOiM6lxJm9W0sE55bo6U:4f+5INhrKmsxFM6+sepXd+3Ps1PvQb
TLSH
T166566C5663F802DCE0B7C678C6264A13D6B2BC165771D7CF1264956A0F33BE18E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-09_a3ef5758c6fb624a03e4913c4059a203_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 5.9MB

2026-08-09_a3ef5758c6fb624a03e4913c4059a203_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 8610526ed2420687e5292a18da445809
SHA256 61a9274cb8fac69b496ab639f0eed19d2134ffe6dd25cbefcbb7427bac354ccd
MD5 a3ef5758c6fb624a03e4913c4059a203
SHA1 34059bb7278b0bb3888dad3ca56ea5194c107440
SHA512 146ca95c25c5525ffb19432fe7237e1dc30281904886e6721c6b7dd6afdc2d9d984631bb0e5d4008e4eac9439fa8b8905696334710bda28206fb12a6c36222ea
SSDEEP 49152:y+VwASOMGtlq1gIU6i5IojJWvVCi/rYeOaTiLBszmWUekOiM6lxJm9W0sE55bo6U:4f+5INhrKmsxFM6+sepXd+3Ps1PvQb
TLSH
T166566C5663F802DCE0B7C678C6264A13D6B2BC165771D7CF1264956A0F33BE18E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a9:ce:a5:cc:aa:bf:65:2a:e8:42:37:40:f4:53:76:54:34:93:ca:ba:44:00:7f:24:8c:f8:d3:fc:64:4f:fc:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 13, 2026

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

a9:ce:a5:cc:aa:bf:65:2a:e8:42:37:40:f4:53:76:54:34:93:ca:ba:44:00:7f:24:8c:f8:d3:fc:64:4f:fc:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Jan 13, 2026

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

8e:16:4d:af:c3:f8:f3:70:ec:5e:8d:77:d0:82:e3:95

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2025 - Aug 22, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:3c:4a:61:fb:35:78:d2:b6:dd:00:00:00:00:01:3c

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

2490604

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSEnumerateSessionsW

powrprof

PowerWriteDCValueIndex PowerReadDCValueIndex PowerSettingUnregisterNotification PowerUnregisterFromEffectivePowerModeNotifications PowerWriteACValueIndex PowerReadFriendlyName PowerEnumerate PowerReadValueMax PowerReadValueMin PowerGetActiveScheme PowerReadACValueIndex PowerSetActiveScheme

kernel32

SetThreadAffinityMask TryEnterCriticalSection FindFirstFileW SetHandleInformation EnterCriticalSection FindNextFileW GetModuleHandleExW TerminateProcess RemoveDirectoryW SetThreadPriority LeaveCriticalSection CreatePipe InitializeCriticalSection SetFilePointer GetEnvironmentVariableW SetEndOfFile PeekNamedPipe FindClose GetLocaleInfoW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA GetFileInformationByHandle FormatMessageW GetFileAttributesExW GetCurrentThread TerminateThread QueryPerformanceFrequency DeleteFileW GetCurrentDirectoryW ReplaceFileW ExitProcess GetModuleHandleW CopyFileW QueryPerformanceCounter MoveFileW GetDriveTypeW IsDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers OpenEventW OpenMutexW SetLastError FileTimeToSystemTime LoadLibraryExW VerifyVersionInfoW VerSetConditionMask GetFullPathNameW SetEnvironmentVariableW SetFilePointerEx GetFileSizeEx LCMapStringW UnregisterWaitEx WriteConsoleInputW SetConsoleCursorPosition GetConsoleScreenBufferInfo WriteConsoleW ReadConsoleInputW GetNumberOfConsoleInputEvents GetNamedPipeHandleStateA CreateNamedPipeW WriteFile CancelIo ReadFile lstrcpyW CreateThread WaitForSingleObjectEx lstrcatW SetEvent CreateEventW lstrlenW OutputDebugStringW CreateFileW DeviceIoControl DecodePointer DeleteCriticalSection GetLastError RaiseException GetTempPathW GetSystemDirectoryA GetSystemWindowsDirectoryW GetModuleFileNameW MultiByteToWideChar FlsGetValue CloseHandle GetExitCodeProcess CreateToolhelp32Snapshot GetProcessId CreateDirectoryW InitializeCriticalSectionEx GetProcAddress CancelSynchronousIo SetNamedPipeHandleState CreateFileA DebugBreak FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcess IsWow64Process2 GetLongPathNameW ReadDirectoryChangesW LoadLibraryExA GetStartupInfoW FindFirstFileExW QueueUserWorkItem PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetErrorMode ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode RtlVirtualUnwind SetConsoleCtrlHandler UnregisterWait RegisterWaitForSingleObject SwitchToThread CancelIoEx ReleaseMutex CreateMutexW GetSystemFirmwareTable GetLogicalDriveStringsW Sleep CreateProcessW OpenProcess ProcessIdToSessionId Process32NextW LoadLibraryW GetSystemDirectoryW FreeLibrary LocalAlloc LocalFree CreateSemaphoreA ReleaseSemaphore SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable AreFileApisANSI SleepConditionVariableSRW EncodePointer LCMapStringEx GetSystemTime SystemTimeToFileTime RtlUnwind FlsAlloc DuplicateHandle HeapSize GetProcessHeap GetOEMCP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CompareStringW HeapAlloc HeapFree GetCommandLineW GetCommandLineA GetConsoleOutputCP SetStdHandle SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionAndSpinCount GetCPInfo GetStringTypeW FlsFree FlsSetValue WTSGetActiveConsoleSessionId Process32FirstW GetSystemPowerStatus GetCurrentProcessId GetTimeZoneInformation ConnectNamedPipe GetOverlappedResult DisconnectNamedPipe WaitForSingleObject WaitForMultipleObjects GetEnvironmentVariableA GetSystemTimeAsFileTime ResetEvent CreateEventA WideCharToMultiByte InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetStdHandle GetFileType LoadLibraryA FormatMessageA GetACP ConvertFiberToThread ConvertThreadToFiberEx

user32

DefWindowProcW PostMessageW DestroyWindow UnregisterSuspendResumeNotification RegisterClassExW EnumWindows TranslateMessage GetWindowTextW AttachThreadInput GetWindowThreadProcessId wsprintfW UnregisterClassW RegisterPowerSettingNotification RegisterSuspendResumeNotification CreateWindowExW SendMessageTimeoutW GetSystemMetrics MapVirtualKeyW DispatchMessageA GetMessageA MessageBoxW GetUserObjectInformationW GetProcessWindowStation UnregisterPowerSettingNotification

advapi32

CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegCloseKey RegOpenKeyExW RegQueryValueExW DeleteService QueryServiceStatus ControlService CreateServiceW OpenServiceW OpenSCManagerW CloseServiceHandle CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetKnownFolderPath SHGetSpecialFolderPathW

ole32

CoUninitialize StringFromCLSID CoSetProxyBlanket CoTaskMemFree CoTaskMemAlloc CoInitializeEx OleUninitialize CoCreateInstance OleInitialize CoCreateFreeThreadedMarshaler CoInitializeSecurity

oleaut32

SafeArrayCreate SafeArrayAccessData VariantInit SafeArrayGetElement SafeArrayGetUBound SafeArrayUnaccessData VariantClear SysAllocString SysFreeString GetErrorInfo SafeArrayGetLBound SetErrorInfo SafeArrayPutElement SysStringLen

shlwapi

PathRemoveFileSpecW PathAppendW

hid

HidD_GetPreparsedData HidD_GetInputReport HidP_GetButtonCaps HidD_GetProductString HidD_GetManufacturerString HidP_GetCaps HidD_GetAttributes HidD_FreePreparsedData HidD_SetFeature HidD_GetFeature HidD_GetHidGuid

cfgmgr32

CM_Get_Child CM_Get_Sibling

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDevicePropertyW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

rpcrt4

UuidFromStringA

wininet

InternetOpenW InternetCrackUrlW InternetWriteFile HttpSendRequestExW InternetCloseHandle InternetConnectW InternetSetOptionW FtpOpenFileW HttpOpenRequestW HttpEndRequestW InternetSetFilePointer HttpQueryInfoW InternetReadFile

ws2_32

shutdown WSASetLastError getservbyname getservbyport gethostbyaddr WSACleanup gethostbyname __WSAFDIsSet bind closesocket select listen getaddrinfo WSAStartup WSAIoctl send socket ntohs connect inet_ntoa recv getsockopt htonl htons freeaddrinfo sendto ioctlsocket setsockopt WSAGetLastError WSASocketW WSARecv WSARecvFrom inet_addr accept

winmm

timeGetTime timeKillEvent timeBeginPeriod

bcrypt

BCryptGenRandom

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertCloseStore CertGetCertificateContextProperty

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=259, version=30795,

count=209, id=261, version=30795,

count=6, id=253, version=28518,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=108, id=261, version=30034,

count=35, id=260, version=31933,

count=1, id=261, version=32215,

count=6, id=260, version=32215,

count=783, id=260, version=31935,

count=31, productName=Unmarked objects (old),

count=1, id=260, version=32825,

count=1, id=261, version=32534,

count=38, id=260, version=30795,

count=2, id=262, version=30795,

count=1, id=263, version=30795,

count=45, id=257, version=30795,

count=533, id=1, productName=Unmarked objects,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=67, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,