2026-08-13_ec68bacd39e3d0c48bd5a308f5fad18e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_ec68bacd39e3d0c48bd5a308f5fad18e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 3.9MB
Sample260813-dfdrfayves
SHA256 c1e94fb1069cf6f72ab46f5f19ddf3dc87f1df2dce84791c2baa6aabf02ecb00
MD5 ec68bacd39e3d0c48bd5a308f5fad18e
SHA1 350b4530911bbb0954afe384103f560b7e72d2b1
SHA512 52c5ab221c00e0c14b40e08f874d5b1a13e7e537ca1f35b9c8c20e98a51375db9825e21130c51a9543ac1bae61893a3ed20a742b9c40bf99b1814d01f8c8d54a
SSDEEP 98304:cFpgUTiHVHet6U4ouiTPsInDKZFxsyOXttYzP:cpTf4ouiTPsInDKls7Y
TLSH
T11916AE5BA2B502FCC077D178C666D707EBB2745903209BDB03D08AAA2F676E15E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_ec68bacd39e3d0c48bd5a308f5fad18e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-13_ec68bacd39e3d0c48bd5a308f5fad18e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 3.9MB

2026-08-13_ec68bacd39e3d0c48bd5a308f5fad18e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 14679cac17610956568cb34006e3697e
SHA256 c1e94fb1069cf6f72ab46f5f19ddf3dc87f1df2dce84791c2baa6aabf02ecb00
MD5 ec68bacd39e3d0c48bd5a308f5fad18e
SHA1 350b4530911bbb0954afe384103f560b7e72d2b1
SHA512 52c5ab221c00e0c14b40e08f874d5b1a13e7e537ca1f35b9c8c20e98a51375db9825e21130c51a9543ac1bae61893a3ed20a742b9c40bf99b1814d01f8c8d54a
SSDEEP 98304:cFpgUTiHVHet6U4ouiTPsInDKZFxsyOXttYzP:cpTf4ouiTPsInDKls7Y
TLSH
T11916AE5BA2B502FCC077D178C666D707EBB2745903209BDB03D08AAA2F676E15E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2763936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

dxgi

CreateDXGIFactory1 CreateDXGIFactory2

dwmapi

DwmExtendFrameIntoClientArea

gdi32

GetPixel GetDeviceCaps

user32

IsWindow GetClientRect TranslateMessage DispatchMessageW PeekMessageW SetLayeredWindowAttributes EnumDisplaySettingsW SendInput SetWindowPos GetCursorPos OpenClipboard CloseClipboard SetClipboardData MonitorFromPoint EmptyClipboard GetWindowTextA GetWindowThreadProcessId wsprintfW TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow GetDC ReleaseDC SetCursorPos LoadCursorW MessageBoxA GetWindowRect UpdateWindow SetCursor ClientToScreen ScreenToClient MonitorFromWindow SetProcessDPIAware IsWindowVisible EnumWindows GetKeyboardLayout GetSystemMetrics GetAsyncKeyState SetWindowDisplayAffinity GetClipboardData PostMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow

winmm

timeBeginPeriod timeEndPeriod

bcrypt

BCryptFinishHash BCryptHashData BCryptGenRandom BCryptCreateHash BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize CoSetProxyBlanket

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

crypt32

CertCloseStore CryptUnprotectData CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW CertEnumCertificatesInStore CertOpenStore PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptProtectData

secur32

InitSecurityInterfaceW

ws2_32

WSAStartup gethostname ioctlsocket sendto recvfrom listen htonl ntohl getaddrinfo freeaddrinfo inet_pton inet_ntop select getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent __WSAFDIsSet WSAIoctl WSAWaitForMultipleEvents WSAGetLastError WSASetLastError WSACleanup accept bind closesocket connect getpeername getsockname htons ntohs recv setsockopt socket

iphlpapi

if_nametoindex

kernel32

RaiseException GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx GetModuleHandleExW GetStringTypeW EncodePointer DecodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlLookupFunctionEntry FlsAlloc FlsGetValue SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive GetExitCodeThread FlsSetValue FlsFree RtlUnwind GetCommandLineA GetCommandLineW ExitThread FreeLibraryAndExitThread GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetFilePointerEx IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetExitCodeProcess CreatePipe GetTimeZoneInformation SetStdHandle SetEndOfFile IsDebuggerPresent UnhandledExceptionFilter LoadLibraryExW GetDateFormatW GetTimeFormatW IsValidCodePage GetACP CompareStringW GetLocaleInfoW WaitForSingleObject SetWaitableTimerEx CloseHandle HeapAlloc HeapFree GetProcessHeap Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId OpenThread CreateProcessW OpenProcess GetTickCount GetSystemFirmwareTable VirtualProtect GetModuleFileNameW GetModuleHandleW GetProcAddress QueryFullProcessImageNameW WideCharToMultiByte CreateToolhelp32Snapshot Module32FirstW Module32NextW GetSystemTimePreciseAsFileTime CreateDirectoryW CreateFileW FileTimeToLocalFileTime GetLocalTime FileTimeToSystemTime GetLastError CreateWaitableTimerExW DeleteFileW MoveFileExW MultiByteToWideChar GetSystemTimes QueryPerformanceCounter QueryPerformanceFrequency SetEvent CreateEventW ReleaseMutex OpenEventA MapViewOfFile UnmapViewOfFile OpenMutexA OpenFileMappingA ReadFile WriteFile LocalFree AllocConsole FreeConsole GetFileAttributesA CreateThread GetTickCount64 GetSystemDirectoryW VirtualQuery GetModuleFileNameA LoadLibraryExA AddDllDirectory SetDefaultDllDirectories SetDllDirectoryW VirtualFree VirtualLock VirtualUnlock GetOverlappedResult CancelIo CreateFileA FlushFileBuffers FreeLibrary LoadLibraryW ClearCommError GetCommState SetCommState SetCommTimeouts DuplicateHandle GetFileAttributesW GetFileSizeEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree VerSetConditionMask LoadLibraryA GetLocaleInfoA FindClose FindFirstFileW FindNextFileW MoveFileW GetTempFileNameW RemoveDirectoryW GetTempPathW ResetEvent WaitForMultipleObjects HeapReAlloc CreateFileMappingA SetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageA SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetFullPathNameW InitializeConditionVariable GetEnvironmentVariableA VerifyVersionInfoW GetStdHandle GetFileType PeekNamedPipe WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx InitializeCriticalSection GetSystemInfo GetOEMCP LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize WriteConsoleW GetModuleHandleA

comdlg32

GetOpenFileNameW

advapi32

CryptReleaseContext ConvertSidToStringSidA GetTokenInformation OpenProcessToken RegDeleteKeyA RegCreateKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegCreateKeyExW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW CryptAcquireContextW RegCloseKey CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036

shell32

ShellExecuteA ShellExecuteW

ntdll

RtlPcToFileHeader

shlwapi

PathFindFileNameW

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

706KB

Virtual Size

705KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

174KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ident

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_ec68bacd39e3d0c48bd5a308f5fad18e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

d3d11

dxgi

dwmapi

gdi32

user32

winmm

bcrypt

ole32

oleaut32

crypt32

secur32

ws2_32

iphlpapi

kernel32

comdlg32

advapi32

shell32

ntdll

shlwapi

wintrust

dnsapi

imm32

generic