overwatch | 2026-08-12_328295bb9d509db7e74245a425dbb7d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_328295bb9d509db7e74245a425dbb7d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat
Size 2.4MB
Sample260812-l3abjathmf
SHA256 f013d927d4057f32bafbcb9f464b5203616529b190175be44ba509d7ba76efe6
MD5 328295bb9d509db7e74245a425dbb7d7
SHA1 21e1efbd1c54303071bab4e56b60af17f74149c9
SHA512 e9aef54d656d1b9c9e57e7e5b5f8cdd867dc70042047965a071f004b8145f97f761d47c93aa18fd0746cb860f16cf6933340db670586cd8a0d5e9a127b1c9596
SSDEEP 49152:ScIKmjtitHaaNZV/Ovfe/PFJdG5CYUzDC0QOu/rT:jAtCHaaHVmv2HFJgAvxeT
TLSH
T106C5D01AA3B400FCD0B7D2B4CE569907DBB2B8461234969F03D189A62F67B719F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer overwatch

Malware Config

Extracted

Family

overwatch

http://136.243.152.105

Signatures

Family: OverWatch
OverWatch is a Windows stealer written in C++.
stealer overwatch

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_328295bb9d509db7e74245a425dbb7d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-08-12_328295bb9d509db7e74245a425dbb7d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat

.exe 2.4MB

2026-08-12_328295bb9d509db7e74245a425dbb7d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat

IMPHASH 7d2bd09ae9d9b74185a09a128003b5c1
SHA256 f013d927d4057f32bafbcb9f464b5203616529b190175be44ba509d7ba76efe6
MD5 328295bb9d509db7e74245a425dbb7d7
SHA1 21e1efbd1c54303071bab4e56b60af17f74149c9
SHA512 e9aef54d656d1b9c9e57e7e5b5f8cdd867dc70042047965a071f004b8145f97f761d47c93aa18fd0746cb860f16cf6933340db670586cd8a0d5e9a127b1c9596
SSDEEP 49152:ScIKmjtitHaaNZV/Ovfe/PFJdG5CYUzDC0QOu/rT:jAtCHaaHVmv2HFJgAvxeT
TLSH
T106C5D01AA3B400FCD0B7D2B4CE569907DBB2B8461234969F03D189A62F67B719F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2252188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

shell32

SHGetKnownFolderPath CommandLineToArgvW

advapi32

RegQueryValueExW GetUserNameW CryptReleaseContext RegOpenKeyExW RegCloseKey RegCreateKeyExW CryptAcquireContextA CryptGenRandom RegSetValueExW

user32

PostQuitMessage AddClipboardFormatListener SetClipboardData RemoveClipboardFormatListener GetClipboardData TranslateMessage EmptyClipboard CloseClipboard DispatchMessageW OpenClipboard IsWindow RegisterClassExW CreateWindowExW DestroyWindow DefWindowProcW GetMessageW ShowWindow GetSystemMetrics

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGetProperty BCryptDeriveKeyPBKDF2

ole32

CoTaskMemFree

crypt32

CryptBinaryToStringA CryptStringToBinaryA

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpSetOption WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpCrackUrl WinHttpOpen WinHttpQueryDataAvailable

ws2_32

WSACleanup __WSAFDIsSet accept bind closesocket select listen WSAStartup getsockname recv WSAGetLastError setsockopt htons htonl send ntohs socket

dbghelp

SymSetOptions SymGetLineFromAddr64 SymInitialize SymFromAddr

iphlpapi

GetAdaptersAddresses

kernel32

GetCommandLineA GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary FreeEnvironmentStringsW CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetEnvironmentVariableW SetStdHandle WriteConsoleW RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW QueryPerformanceFrequency GetLocaleInfoEx GetFileInformationByHandleEx CreateFile2 SetFileInformationByHandle GetFinalPathNameByHandleW FindFirstFileW GetCurrentDirectoryW QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA ExitThread MultiByteToWideChar GetModuleFileNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCurrentProcess GetStdHandle GetModuleFileNameW GetEnvironmentVariableW GetEnvironmentVariableA RtlCaptureStackBackTrace Sleep WideCharToMultiByte SetConsoleOutputCP VirtualQuery GetGeoInfoW GetComputerNameExW GetLogicalProcessorInformation GetSystemInfo GetUserGeoID GetProcAddress GetModuleHandleW ExpandEnvironmentStringsW CloseHandle GetFileSizeEx VirtualProtect SetLastError VirtualFree WriteFile VirtualAlloc GetTickCount64 GetLastError AttachConsole CreateFileA GetNativeSystemInfo FlushInstructionCache GetSystemTimeAsFileTime AllocConsole FlushFileBuffers GetTempPathW GetTempFileNameW CreateDirectoryW ReadFile FindFirstFileExW FindNextFileW FindClose CreateFileW GetFileAttributesW CopyFile2 CopyFileW RtlUnwind GetCurrentProcessId WaitForSingleObject SetFilePointer CreateProcessW GetExitCodeThread GetTickCount GetExitCodeProcess CreateRemoteThread SetConsoleCtrlHandler GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocalTime GetComputerNameW GetSystemTime HeapFree GetPhysicallyInstalledSystemMemory GetCommandLineW FreeConsole HeapAlloc LocalFree ExitProcess GetProcessHeap GetConsoleWindow AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize DeleteCriticalSection SystemTimeToFileTime

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-08-12_328295bb9d509db7e74245a425dbb7d7_cobalt-strike_glassworm_icedid_luca-stealer_njrat

version

shell32

advapi32

user32

bcrypt

ole32

crypt32

winhttp

ws2_32

dbghelp

iphlpapi

kernel32

generic