2026-08-09_91a5c5ebcb27abee41500c2637022de1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_91a5c5ebcb27abee41500c2637022de1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 3.5MB
Sample260809-l1m5lsvgnf
SHA256 8e690b866307dd36ac0a36c44af5e491a0975e4c1d6a584cbc83d36e853aef92
MD5 91a5c5ebcb27abee41500c2637022de1
SHA1 5785631ba2e99b72e21b471eec06f116201d0dc0
SHA512 71ef59bb57d926f8e0a500499b0c5f13fbdb69078da412f4a555f7adf5eaee84ade3b8f06023a8e950605668aa67e7a82ba5e9f44854334a37423574d4eba457
SSDEEP 49152:xC6UNgWsZ6H5aat0VXtD7bS9hUfq/TSQKowr1JHOS:2LsEHpU
TLSH
T1E1F5AE7A966610FEE0A6C574C9031917EF367807033596CB9AC0957A6F67AF08E3E730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_91a5c5ebcb27abee41500c2637022de1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-09_91a5c5ebcb27abee41500c2637022de1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 3.5MB

2026-08-09_91a5c5ebcb27abee41500c2637022de1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH b31424dd5276556011f2d6c2340c9d5d
SHA256 8e690b866307dd36ac0a36c44af5e491a0975e4c1d6a584cbc83d36e853aef92
MD5 91a5c5ebcb27abee41500c2637022de1
SHA1 5785631ba2e99b72e21b471eec06f116201d0dc0
SHA512 71ef59bb57d926f8e0a500499b0c5f13fbdb69078da412f4a555f7adf5eaee84ade3b8f06023a8e950605668aa67e7a82ba5e9f44854334a37423574d4eba457
SSDEEP 49152:xC6UNgWsZ6H5aat0VXtD7bS9hUfq/TSQKowr1JHOS:2LsEHpU
TLSH
T1E1F5AE7A966610FEE0A6C574C9031917EF367807033596CB9AC0957A6F67AF08E3E730
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1459784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpAddRequestHeaders

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusShutdown GdipFree GdipGetImageEncoders GdiplusStartup

kernel32

LoadLibraryExW GetFileType UnhandledExceptionFilter GetLastError SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree ExitProcess GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA VirtualProtect WriteProcessMemory GetCurrentProcess CreateNamedPipeW PeekNamedPipe WaitForSingleObject GetCurrentThreadId DisconnectNamedPipe GetTempPathA VirtualProtectEx VirtualAllocEx GetCurrentProcessId CreateProcessW CreateRemoteThread VirtualFreeEx GetTickCount ConnectNamedPipe FlushFileBuffers GlobalAlloc GlobalLock GlobalUnlock GetSystemTime GetModuleFileNameA GetVersionExW SetCurrentDirectoryA LoadLibraryA GetProcAddress CreateProcessA GetTimeZoneInformation GetSystemInfo GlobalMemoryStatusEx GetLocalTime SetFilePointerEx GetConsoleWindow GetConsoleOutputCP AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc RaiseException LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime RtlUnwind GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleOutputCP ReadConsoleW FindClose GetConsoleMode GetExitCodeProcess GetFileSizeEx FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SetConsoleCP FreeLibrary FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

user32

OpenClipboard GetSystemMetrics GetDC CloseClipboard ReleaseDC QueryDisplayConfig EmptyClipboard SetClipboardData GetClipboardData

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps BitBlt

advapi32

CryptAcquireContextA RegOpenKeyExA GetUserNameA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegEnumKeyExW OpenProcessToken RegOpenKeyExW RegGetValueW GetTokenInformation CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyA SetupDiGetDevicePropertyW SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryAcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtCreateRenderContext EvtQuery EvtNext EvtRender EvtClose

ntdll

NtWriteVirtualMemory NtProtectVirtualMemory RtlInitUnicodeString

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_91a5c5ebcb27abee41500c2637022de1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

winhttp

crypt32

bcrypt

gdiplus

kernel32

user32

gdi32

advapi32

setupapi

api-ms-win-core-realtime-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

ntdll

generic