2026-08-09_34a7803353eb39d8efd57eabb053342a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_34a7803353eb39d8efd57eabb053342a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 3.5MB
Sample260809-nak9faab84
SHA256 aadcd8ec5791e7fd6950ed52ebbeeb761b5b2bc85b03955afcbb709614f2f136
MD5 34a7803353eb39d8efd57eabb053342a
SHA1 5437474b79eb008881a6978ff538c1df5cffd710
SHA512 a0e7b468f672d2e8a5b37bcb9e2514baab5e9b1041b0f2506c4ed562446bce9093650c872d34d50812b23c73afe792c5aea6f78b5363617d43058a2503ddbf67
SSDEEP 49152:aEc3O9ukp6kx+8DHnnKQXWRLlMM1WtJ44/TSQKowr1JwrSjis:7Xp6kJDESs
TLSH
T10EF5AE3A966A10FEE0A6C574C9022917EF357807037496DB5AC095BA6F67AF04E3F730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_34a7803353eb39d8efd57eabb053342a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-09_34a7803353eb39d8efd57eabb053342a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 3.5MB

2026-08-09_34a7803353eb39d8efd57eabb053342a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH f7bb9e2fd71832de229fa7704d54d513
SHA256 aadcd8ec5791e7fd6950ed52ebbeeb761b5b2bc85b03955afcbb709614f2f136
MD5 34a7803353eb39d8efd57eabb053342a
SHA1 5437474b79eb008881a6978ff538c1df5cffd710
SHA512 a0e7b468f672d2e8a5b37bcb9e2514baab5e9b1041b0f2506c4ed562446bce9093650c872d34d50812b23c73afe792c5aea6f78b5363617d43058a2503ddbf67
SSDEEP 49152:aEc3O9ukp6kx+8DHnnKQXWRLlMM1WtJ44/TSQKowr1JwrSjis:7Xp6kJDESs
TLSH
T10EF5AE3A966A10FEE0A6C574C9022917EF357807037496DB5AC095BA6F67AF04E3F730
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1465688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpAddRequestHeaders

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptGenerateSymmetricKey

gdiplus

GdipSaveImageToStream GdipCloneImage GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipGetImageEncoders GdipAlloc GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP

kernel32

LoadLibraryExW GetFileType UnhandledExceptionFilter GetLastError SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree ExitProcess GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA VirtualProtect WriteProcessMemory GetCurrentProcess CreateNamedPipeW PeekNamedPipe WaitForSingleObject GetCurrentThreadId DisconnectNamedPipe GetTempPathA VirtualProtectEx VirtualAllocEx GetCurrentProcessId CreateProcessW CreateRemoteThread VirtualFreeEx GetTickCount ConnectNamedPipe FlushFileBuffers GlobalAlloc GlobalLock GlobalUnlock GetSystemTime GetModuleFileNameA GetVersionExW SetCurrentDirectoryA CreateProcessA GetTimeZoneInformation GetSystemInfo GlobalMemoryStatusEx GetLocalTime SetConsoleCP GetConsoleWindow SetFilePointerEx GetExitCodeProcess GetConsoleOutputCP TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc RaiseException LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap RtlUnwind FreeLibrary GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW AreFileApisANSI ReadConsoleW FindClose GetConsoleMode ReadFile GetFileSizeEx FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SetConsoleOutputCP SystemTimeToFileTime FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

user32

OpenClipboard GetSystemMetrics GetDC CloseClipboard ReleaseDC QueryDisplayConfig EmptyClipboard SetClipboardData GetClipboardData

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps BitBlt

advapi32

CryptAcquireContextA RegOpenKeyExA GetUserNameA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegEnumKeyExW OpenProcessToken RegOpenKeyExW RegGetValueW GetTokenInformation CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiGetDevicePropertyW

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive InitializeCriticalSectionEx AcquireSRWLockExclusive TryAcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtClose EvtQuery EvtNext EvtRender EvtCreateRenderContext

ntdll

RtlInitUnicodeString

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_34a7803353eb39d8efd57eabb053342a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

winhttp

crypt32

bcrypt

gdiplus

kernel32

user32

gdi32

advapi32

setupapi

api-ms-win-core-realtime-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

ntdll

generic