2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
Size 6.0MB
Sample260810-rd82fsgf75
SHA256 7f2b83a86f31bd78510432551ba35044ace72bcee05d1be938053619f664cdfd
MD5 1ea4a045f0a27363877e2f6b8b842bf2
SHA1 73c4df215d4b004210dda8ea85dc397e10a9f12e
SHA512 5498d327567b2750c678a8dae0f37f85b8b9af68b682713b188b04e1792b496da2e302284385c41d7c13362eb421fa2c386d9ef75c816a79586173a1fdcab229
SSDEEP 98304:Xl+0x9FjO509xZqNcxfH64NWgr28z4V5YtH:1hx9M509XqNcxfH64IF8zM5
TLSH
T13856AE56A6A450ECD5B7C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

File Explorer

2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

.exe 6.0MB

2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

IMPHASH 7df38e7ed5c3951c98bd977e3eb4cc23
SHA256 7f2b83a86f31bd78510432551ba35044ace72bcee05d1be938053619f664cdfd
MD5 1ea4a045f0a27363877e2f6b8b842bf2
SHA1 73c4df215d4b004210dda8ea85dc397e10a9f12e
SHA512 5498d327567b2750c678a8dae0f37f85b8b9af68b682713b188b04e1792b496da2e302284385c41d7c13362eb421fa2c386d9ef75c816a79586173a1fdcab229
SSDEEP 98304:Xl+0x9FjO509xZqNcxfH64NWgr28z4V5YtH:1hx9M509XqNcxfH64IF8zM5
TLSH
T13856AE56A6A450ECD5B7C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2006376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\steamexe\win64\Release\steamexe.pdb

kernel32

GetExitCodeProcess GetCurrentProcess WaitForSingleObject SystemTimeToFileTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe WriteFile IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ExitProcess RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GlobalAlloc SizeofResource LockResource OpenProcess LoadResource GetModuleFileNameW GetProductInfo GetVersionExA SetStdHandle GetFullPathNameW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress GetCurrentThreadId Sleep CreateSymbolicLinkW DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW InitializeSListHead SleepConditionVariableSRW GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SetProcessAffinityMask GetProcessHeaps DebugBreak SetUnhandledExceptionFilter GetProcessAffinityMask GetSystemInfo GetLastError ProcessIdToSessionId CreateProcessW OutputDebugStringW SetCurrentDirectoryW SetEnvironmentVariableW SetThreadAffinityMask TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId OpenEventA SetEvent SetErrorMode CloseHandle ResumeThread SuspendThread GetExitCodeThread TerminateThread SetThreadPriority OpenThread RemoveDirectoryA GetFileAttributesA MultiByteToWideChar LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetFileType GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetDateFormatW GetTimeFormatW GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent CreateEventA WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent TerminateProcess GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree RtlCaptureStackBackTrace GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread

user32

GetDC CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW DestroyWindow GetWindowThreadProcessId EnumWindows GetUserObjectInformationW IsWindowVisible ReleaseDC GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer SetTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow MsgWaitForMultipleObjects SetWindowPos MoveWindow GetProcessWindowStation AllowSetForegroundWindow MessageBoxA ShowWindow

gdi32

RemoveFontMemResourceEx TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegSetValueExW RegQueryValueExW ReportEventW

shell32

ord680 SHGetFileInfoW CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

comctl32

InitCommonControlsEx

psapi

GetModuleInformation GetProcessMemoryInfo GetModuleFileNameExW

version

VerQueryValueW

crypt32

CertOpenStore CertGetCertificateChain CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

send htonl htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError recv WSARecvFrom WSASend WSASendTo WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup connect bind WSAIoctl setsockopt getsockname WSARecv ioctlsocket

wsock32

ord1142

bcrypt

BCryptGenRandom

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_1ea4a045f0a27363877e2f6b8b842bf2_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic