2026-08-11_e7085f8939d54c537a47ab8aa593e17c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_e7085f8939d54c537a47ab8aa593e17c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.4MB
Sample260811-lbef6sbm7v
SHA256 26d530fb9bca2fc3035b8f090cb4ef09e121e284da43a11fc8002b28bc9f8abc
MD5 e7085f8939d54c537a47ab8aa593e17c
SHA1 f0e63c82c92c65f02a0835104e8d6546667de822
SHA512 c72d71eb898b7bb90c84cb4bc81d01b3d0c320417864a6887f72304622b173f0b2f7d740177fe806450bac61cc9cfba987a3036b4dac3fd8047f0b2ea5cdeb83
SSDEEP 49152:2hoMYEugYEbuHuCj8oG6WbuqV731ZCP10ouSHyNHYPgbNqGRs:btG6WbuiC90o5HyNHpf
TLSH
T1C7F5AE117BDC56AFC1EF82B99A614602E772F84A1321EBCF0384A6B61D137D44D397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_e7085f8939d54c537a47ab8aa593e17c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-11_e7085f8939d54c537a47ab8aa593e17c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.4MB

2026-08-11_e7085f8939d54c537a47ab8aa593e17c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 61d56a64ca201345632214000d593bf2
SHA256 26d530fb9bca2fc3035b8f090cb4ef09e121e284da43a11fc8002b28bc9f8abc
MD5 e7085f8939d54c537a47ab8aa593e17c
SHA1 f0e63c82c92c65f02a0835104e8d6546667de822
SHA512 c72d71eb898b7bb90c84cb4bc81d01b3d0c320417864a6887f72304622b173f0b2f7d740177fe806450bac61cc9cfba987a3036b4dac3fd8047f0b2ea5cdeb83
SSDEEP 49152:2hoMYEugYEbuHuCj8oG6WbuqV731ZCP10ouSHyNHYPgbNqGRs:btG6WbuiC90o5HyNHpf
TLSH
T1C7F5AE117BDC56AFC1EF82B99A614602E772F84A1321EBCF0384A6B61D137D44D397A3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

746352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WritePrivateProfileStringW MultiByteToWideChar WideCharToMultiByte Sleep GetCurrentProcessId CreateFileMappingW MapViewOfFile GetProcAddress LoadLibraryW GetTempPathW DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW GetModuleHandleA GetModuleHandleW LoadLibraryA ReadFile WaitNamedPipeW UnmapViewOfFile GetPrivateProfileStringW LoadResource LockResource SizeofResource FindResourceW GetFileAttributesW FreeLibrary LoadLibraryExW GetProcessTimes GetSystemTimeAsFileTime IsWow64Process SetLastError GetFileSizeEx WaitForSingleObject ResumeThread QueryFullProcessImageNameW CreateDirectoryW LocalFree SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetLastError CloseHandle WriteFile GetCurrentProcess CreateFileW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread EncodePointer EnterCriticalSection LeaveCriticalSection CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead IsDebuggerPresent OutputDebugStringW RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess IsProcessorFeaturePresent GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileType VirtualProtect RtlUnwind

user32

MessageBoxW MessageBoxA SetProcessDPIAware

advapi32

SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW ConvertStringSidToSidW

shell32

SHGetFolderPathW SHCreateDirectoryExW

ole32

CoUninitialize CoInitializeEx

oleaut32

SysAllocString SysFreeString SafeArrayCreate VariantInit SafeArrayUnaccessData SafeArrayAccessData

mscoree

CLRCreateInstance

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

PlaySoundW

Name

.text

Size

926KB

Virtual Size

925KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

288KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_e7085f8939d54c537a47ab8aa593e17c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

version

winmm

generic