2026-08-10_2fe9e622e8f350a5a34bfb2ea7d6ff7c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_2fe9e622e8f350a5a34bfb2ea7d6ff7c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 2.3MB
Sample260810-dcb4fazdqc
SHA256 82afbcf525607908f00dc026fa0638e756740737a2304c9aa4482c631dc622b9
MD5 2fe9e622e8f350a5a34bfb2ea7d6ff7c
SHA1 a02396c9070252ae881e782034ca63bf218f4780
SHA512 107d185e83ae7a3c5fb5430e811d102c7f937559cbdba4adbc4f1d62c81cee6b54c367a63791215ff55587dd54ad85cb5dad710c783022e4ba8f1d02e6a169bd
SSDEEP 49152:XDdxwUyvi+4oXF3W1QrL1UDq3P8mlp4DOZ:TovdW6OHmrZZ
TLSH
T1E0B58C53D3EC49E6F0775A7088694632AFB27C194B3096DF8246F61E2F32A834D75722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-10_2fe9e622e8f350a5a34bfb2ea7d6ff7c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-10_2fe9e622e8f350a5a34bfb2ea7d6ff7c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 2.3MB

2026-08-10_2fe9e622e8f350a5a34bfb2ea7d6ff7c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 0f09257e903f2692e9b9d8944d8cf0fa
SHA256 82afbcf525607908f00dc026fa0638e756740737a2304c9aa4482c631dc622b9
MD5 2fe9e622e8f350a5a34bfb2ea7d6ff7c
SHA1 a02396c9070252ae881e782034ca63bf218f4780
SHA512 107d185e83ae7a3c5fb5430e811d102c7f937559cbdba4adbc4f1d62c81cee6b54c367a63791215ff55587dd54ad85cb5dad710c783022e4ba8f1d02e6a169bd
SSDEEP 49152:XDdxwUyvi+4oXF3W1QrL1UDq3P8mlp4DOZ:TovdW6OHmrZZ
TLSH
T1E0B58C53D3EC49E6F0775A7088694632AFB27C194B3096DF8246F61E2F32A834D75722
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d5:69:16:b1:b5:a1:d4:85:72:e1:54:01:25:b9:13:43:35:e9:f7:ed:91:01:d2:10:72:4c:d0:3c:65:76:01:ca

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 28, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2023 - Nov 14, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:dd:5d:57:1d:95:d4:ad:aa:1b:00:01:00:00:01:dd

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 12, 2023 - Jan 10, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

475867

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\__w\1\s\exe\x64\Release\procexp64.pdb

shlwapi

ColorRGBToHLS ColorHLSToRGB SHAutoComplete StrCmpIW PathIsNetworkPathW UrlUnescapeW StrStrIW ord176

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable

ws2_32

getservbyport htonl ntohs gethostbyaddr htons WSAStartup ntohl

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon ImageList_Add InitCommonControlsEx ImageList_Destroy ImageList_DrawEx ImageList_GetIconSize ImageList_Create ImageList_AddMasked ImageList_BeginDrag ImageList_EndDrag ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ord17 PropertySheetW CreateStatusWindowW CreatePropertySheetPageW ImageList_GetIcon ord410 ord413

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW

crypt32

CertDuplicateCertificateContext CertGetNameStringW

aclui

ord1

powrprof

SetSuspendState IsPwrHibernateAllowed IsPwrSuspendAllowed

wtsapi32

WTSQuerySessionInformationW WTSEnumerateSessionsW WTSSendMessageW WTSLogoffSession WTSFreeMemory WTSDisconnectSession

uxtheme

CloseThemeData OpenThemeData GetThemePartSize EnableThemeDialogTexture SetWindowTheme DrawThemeBackground

ntdll

NtQuerySemaphore NtQuerySymbolicLinkObject NtQueryObject NtOpenSymbolicLinkObject NtQuerySystemInformation NtSetInformationProcess VerSetConditionMask NtQueryEvent NtCreateKey NtOpenKey NtQuerySection NtSuspendThread NtResumeThread NtSuspendProcess NtOpenThread RtlCreateQueryDebugBuffer RtlQueryProcessDebugInformation RtlDestroyQueryDebugBuffer NtQueryMutant NtQueryInformationProcess NtLoadDriver RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtQueryInformationThread NtResumeProcess RtlUnwind

gdi32

CreateSolidBrush DeleteDC GetBkColor GetBkMode GetDeviceCaps GetStockObject CreatePen RectInRegion SelectClipRgn SelectObject SetBkColor SetDCPenColor SetBkMode SetTextColor GetTextMetricsW MoveToEx Polyline ExtTextOutW SetViewportOrgEx CreateFontIndirectW GetTextExtentPoint32W Rectangle SetTextAlign TextOutW SetMapMode StartDocW EndDoc StartPage EndPage CreateBitmap CreatePatternBrush ExcludeClipRect GetCurrentObject PatBlt Polygon GetTextExtentExPointW RestoreDC SaveDC SetROP2 CreateRectRgnIndirect CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject GetObjectW CreateDIBSection LineTo

comdlg32

ChooseFontW CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW ChooseColorW FindTextW PrintDlgW

kernel32

FileTimeToLocalFileTime GetFileSize GetFileTime GetFullPathNameW GetLongPathNameW WriteFile CloseHandle GetLastError SetErrorMode InitializeCriticalSection Sleep GetCurrentProcess ExitThread TlsAlloc TlsSetValue CreateProcessW OpenProcess GetVersion GetSystemWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile IsWow64Process GetSystemWow64DirectoryW GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree FormatMessageA lstrlenW FileTimeToSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW GetNumberFormatW LCMapStringW Process32FirstW Process32NextW FindFirstFileW GetFileAttributesW GetPrivateProfileStringW FreeLibrary LoadLibraryExW ReadFile MultiByteToWideChar FindClose FindNextFileW EnterCriticalSection LeaveCriticalSection SetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetCurrentThread HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap CreateThread GetExitCodeThread FindResourceExW LoadResource LockResource SizeofResource FindResourceW ExpandEnvironmentStringsW GetVersionExW GetFileSizeEx LoadLibraryW GetTickCount MulDiv GlobalAddAtomW GlobalAlloc GlobalUnlock GlobalLock GetPrivateProfileIntW RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetCurrentThreadId DeleteFileW GetTempFileNameW GetTempPathW GetThreadId FormatMessageW GetCommandLineW GetFileType LocalAlloc TerminateThread GlobalReAlloc Module32FirstW Module32NextW GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime IsBadStringPtrW OpenEventW VerifyVersionInfoW GetEnvironmentVariableW ReadProcessMemory lstrcmpiW GetSystemDirectoryW SearchPathW SetFilePointer GetCurrentProcessId VirtualQueryEx OpenThread SuspendThread ResumeThread GetThreadContext Thread32First Thread32Next QueryPerformanceCounter QueryPerformanceFrequency ResetEvent IsBadReadPtr TerminateProcess SetPriorityClass ProcessIdToSessionId GetProcessId GlobalMemoryStatusEx GetLogicalProcessorInformation SetProcessWorkingSetSize GlobalFree PulseEvent GetComputerNameW WTSGetActiveConsoleSessionId GetCurrentDirectoryW GetDriveTypeW OutputDebugStringW DuplicateHandle DeviceIoControl VirtualAlloc VirtualFree GetProcessWorkingSetSize TrySubmitThreadpoolCallback IsProcessInJob CreateJobObjectW QueryInformationJobObject GetThreadGroupAffinity SetThreadGroupAffinity GlobalMemoryStatus GetProcessAffinityMask SetProcessAffinityMask GetActiveProcessorGroupCount GetActiveProcessorCount WideCharToMultiByte K32GetModuleFileNameExW K32GetMappedFileNameW K32QueryWorkingSet DecodePointer IsDebuggerPresent GetThreadIdealProcessorEx GetTickCount64 QueryThreadCycleTime SystemTimeToTzSpecificLocalTime GetNativeSystemInfo IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetConsoleMode ReadConsoleInputW SetEnvironmentVariableW ReadConsoleW GetTimeZoneInformation GetStdHandle TlsGetValue FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount TlsFree FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetConsoleCP GetSystemInfo VirtualProtect VirtualQuery FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringEx GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetEndOfFile WriteConsoleW GetStringTypeW TryAcquireSRWLockExclusive CreateFileW SetLastError CompareStringW AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer CreateToolhelp32Snapshot GetStartupInfoW

user32

SetMenuDefaultItem AllowSetForegroundWindow AdjustWindowRectEx MessageBeep SetCursorPos ClientToScreen WindowFromPoint SetRectEmpty GetDesktopWindow GetWindow CheckMenuRadioItem MonitorFromPoint GetWindowPlacement CheckDlgButton IsDlgButtonChecked EnableWindow ModifyMenuW TrackPopupMenu SetMenuInfo InvalidateRgn SetClassLongW EnumWindows CopyAcceleratorTableW TranslateAcceleratorW DrawMenuBar IsDialogMessageW GetMenuBarInfo ShowWindowAsync IsIconic EndTask RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW ExitWindowsEx SetLayeredWindowAttributes CreateDialogParamW GetDlgItemTextW CreateMenu GetMenuInfo EndMenu LoadIconW LockWorkStation IsHungAppWindow SendMessageTimeoutW SetDlgItemInt CheckRadioButton MsgWaitForMultipleObjects GetGuiResources CharNextW IsWindowVisible MoveWindow IsChild GetSysColorBrush GetWindowTextLengthW GetWindowTextW SetWindowTextW KillTimer GetClassInfoExW UnregisterClassW DrawIconEx TrackPopupMenuEx SetMenuItemInfoW DestroyMenu EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetScrollInfo SetScrollInfo GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW OffsetRect IntersectRect InflateRect CopyRect SetRect FillRect MapWindowPoints GetCursorPos GetWindowRect GetClientRect GetPropW SetPropW ScrollWindowEx ValidateRect InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW SetTimer ReleaseCapture SetCapture GetCapture GetKeyState GetFocus SetWindowPos CreateWindowExW RegisterClassExW CallWindowProcW DefWindowProcW GetParent SetDlgItemTextW PostMessageW LoadStringW ReleaseDC GetDC EnumDisplaySettingsW LoadImageW DestroyIcon LoadCursorW GetWindowThreadProcessId FindWindowExW FindWindowW SetCursor MessageBoxW SetForegroundWindow DeleteMenu InsertMenuW GetSubMenu CheckMenuItem GetMenu GetSystemMetrics SetFocus ShowWindow WaitForInputIdle SendMessageW RemoveMenu AppendMenuW GetMenuItemCount GetMenuItemID EnableMenuItem CreatePopupMenu GetMenuStringW LoadMenuW LoadAcceleratorsW GetDlgCtrlID SetWindowPlacement IsWindow PostQuitMessage GetMessagePos PeekMessageW DrawEdge TrackMouseEvent LoadStringA DefMDIChildProcW DefFrameProcW DefDlgProcW CreateIconIndirect DestroyWindow EnumChildWindows UnionRect EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DrawFrameControl DialogBoxParamW GetDlgItem EndDialog DialogBoxIndirectParamW GetAncestor GetWindowModuleFileNameW GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetClassNameW SetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect FrameRect DrawFocusRect GetMenuItemInfoW ScreenToClient ShowScrollBar SetScrollPos RedrawWindow GetWindowDC IsWindowEnabled GetSysColor IsZoomed

advapi32

AllocateAndInitializeSid DuplicateTokenEx EqualSid FreeSid GetTokenInformation ImpersonateLoggedOnUser RevertToSelf LookupAccountSidW LookupAccountNameW LookupPrivilegeValueW RegCreateKeyExW RegDeleteKeyW RegEnumKeyW RegEnumValueW RegLoadKeyW RegOpenKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegUnLoadKeyW RegQueryValueW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData AdjustTokenPrivileges RegDeleteValueW CloseServiceHandle GetServiceDisplayNameW OpenSCManagerW OpenServiceW QueryServiceConfig2W ControlService QueryServiceStatus StartServiceW RegCreateKeyW RegGetValueW MapGenericMask QueryServiceObjectSecurity SetServiceObjectSecurity StartTraceW ControlTraceW OpenTraceW ProcessTrace CloseTrace CopySid GetLengthSid QueryServiceConfigW AddAccessAllowedAce AddAce CreateRestrictedToken GetAce GetSidIdentifierAuthority GetSidSubAuthority GetSidSubAuthorityCount InitializeAcl CryptDestroyHash RegCloseKey IsValidSid SetTokenInformation GetSecurityInfo SetSecurityInfo LsaFreeMemory LsaClose LsaOpenPolicy LsaEnumerateAccountRights ConvertSidToStringSidW FlushTraceW RegConnectRegistryW CreateProcessAsUserW GetKernelObjectSecurity SetKernelObjectSecurity LookupPrivilegeNameW EnumServicesStatusExW RegEnumKeyExW OpenProcessToken

shell32

SHGetStockIconInfo SHGetFolderPathW ShellExecuteW SHGetFileInfoW ExtractAssociatedIconW SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc Shell_NotifyIconW ShellExecuteExW ExtractIconExW

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoMarshalInterThreadInterfaceInStream CoInitializeEx CoSetProxyBlanket CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoGetInterfaceAndReleaseStream

oleaut32

SysStringLen SysFreeString SysAllocString SysAllocStringByteLen VarUI4FromStr SysAllocStringLen SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayDestroy VariantChangeType VariantClear VariantInit

msimg32

GradientFill

dwmapi

DwmDefWindowProc DwmSetWindowAttribute

winhttp

WinHttpWriteData WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpSetOption WinHttpGetProxyForUrl WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

293KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

792KB

Virtual Size

791KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_2fe9e622e8f350a5a34bfb2ea7d6ff7c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

PE Signature issue

shlwapi

iphlpapi

ws2_32

mpr

comctl32

version

credui

setupapi

crypt32

aclui

powrprof

wtsapi32

uxtheme

ntdll

gdi32

comdlg32

kernel32

user32

advapi32

shell32

ole32

oleaut32

msimg32

dwmapi

winhttp

generic