2026-08-13_c3a8acc3845dada4d0f14e53a9bc34ae_akira_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_c3a8acc3845dada4d0f14e53a9bc34ae_akira_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_stealc
Size 20.1MB
Sample260813-pc8cesaf56
SHA256 2c776e68ce7af79d8b6b373eb229c955d9c9409953fe5a168dc9ecb31d7959d6
MD5 c3a8acc3845dada4d0f14e53a9bc34ae
SHA1 9a8822c9cd49ddff4770624ff1926781d7db9801
SHA512 04d35495e0746f084cd87a955ccd1e8e3647765d8af9293fdf0c262f8ae8ac70f500b3d383f1180984df6b3f2544a6ce9bd6f0d11ff57999e4a32cb851b2365f
SSDEEP 196608:CSIg/1R8cdn4T+hj0lTKBRGu9BcR+U/QsVjT:CSnHj0MBRGu9BczQsVX
TLSH
T1FD278D17F26541BCD076C075C656A623FB72B84A07306AEB37EC8A253F27BE05A39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-13_c3a8acc3845dada4d0f14e53a9bc34ae_akira_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_stealc

File Explorer

2026-08-13_c3a8acc3845dada4d0f14e53a9bc34ae_akira_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_stealc

.exe 20.1MB

2026-08-13_c3a8acc3845dada4d0f14e53a9bc34ae_akira_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_stealc

IMPHASH 4608cc1adf1300faf75fdb761f318408
SHA256 2c776e68ce7af79d8b6b373eb229c955d9c9409953fe5a168dc9ecb31d7959d6
MD5 c3a8acc3845dada4d0f14e53a9bc34ae
SHA1 9a8822c9cd49ddff4770624ff1926781d7db9801
SHA512 04d35495e0746f084cd87a955ccd1e8e3647765d8af9293fdf0c262f8ae8ac70f500b3d383f1180984df6b3f2544a6ce9bd6f0d11ff57999e4a32cb851b2365f
SSDEEP 196608:CSIg/1R8cdn4T+hj0lTKBRGu9BcR+U/QsVjT:CSnHj0MBRGu9BczQsVX
TLSH
T1FD278D17F26541BCD076C075C656A623FB72B84A07306AEB37EC8A253F27BE05A39711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Detects executables containing URLs to raw contents of a Github gist
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e6:8c:9c:91:08:7a:16:9e:26:31:be:fa:51:0d:48:55:bb:30:92:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SteamDaddy Software Trust Authority

Chains

Aug 6, 2026

CN=SteamDaddy Software Trust Authority

Minor OS version

Major OS version

Entry point

6338240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

steam_daddy.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

GetEnvironmentVariableW OpenProcess SetEnvironmentVariableW GetProcAddress GetCurrentDirectoryW GetEnvironmentStringsW WideCharToMultiByte GetSystemTimePreciseAsFileTime MoveFileExW GetSystemTimeAsFileTime GlobalFree FreeLibrary LoadLibraryExW LoadLibraryW TerminateProcess FormatMessageW HeapAlloc GetQueuedCompletionStatusEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW SetThreadErrorMode GlobalAlloc GlobalUnlock GlobalSize GlobalLock FindNextFileW AddVectoredExceptionHandler WaitForSingleObject QueryPerformanceCounter SwitchToThread QueryPerformanceFrequency InitializeSListHead SetFilePointerEx Process32NextW Process32FirstW CreateToolhelp32Snapshot GetFileInformationByHandle GetLastError CloseHandle GetSystemInfo CreateWaitableTimerExW SetWaitableTimer HeapReAlloc LoadLibraryA HeapFree Sleep PostQueuedCompletionStatus GetCurrentProcessId GetProcessHeap SetThreadStackGuarantee GetCurrentThread CreateThread MultiByteToWideChar GetCurrentThreadId GetModuleHandleA FindClose GetCurrentProcess WaitForSingleObjectEx lstrlenW CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP FreeEnvironmentStringsW WriteConsoleW ReadFileEx SleepEx WriteFileEx GetModuleHandleW CopyFileExW SetFileAttributesW DeleteFileW SetHandleInformation GetTempPathW GetExitCodeProcess GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandleEx WaitForMultipleObjects CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle SetUnhandledExceptionFilter

ntdll

NtOpenFile NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile

shell32

DragAcceptFiles Shell_NotifyIconW DragFinish DragQueryFileW Shell_NotifyIconGetRect

user32

GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo FillRect GetMenuItemInfoW PostQuitMessage CheckMenuItem SystemParametersInfoA RemoveMenu DrawMenuBar SetMenu AppendMenuW DrawIconEx CreatePopupMenu SetMenuItemInfoW VkKeyScanW TrackPopupMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu MessageBoxW CreateIcon RegisterClassW CreateWindowExW DrawTextW GetClassInfoExW CreateMenu SetForegroundWindow ShowWindow FindWindowA DestroyWindow GetClassNameW ToUnicodeEx GetForegroundWindow GetWindowTextW MapVirtualKeyExW GetKeyboardLayout GetWindowTextLengthW GetWindowRect AdjustWindowRectEx GetWindowLongW ValidateRect RegisterTouchWindow GetRawInputData DispatchMessageW TranslateMessage SetWindowLongW CloseTouchInputHandle KillTimer SetTimer EnableMenuItem GetTouchInputInfo GetMessageW RegisterRawInputDevices IsClipboardFormatAvailable GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetSystemMenu ShowCursor ClipCursor GetClipCursor EnumDisplayMonitors SetCursor LoadCursorW GetCursorPos TrackMouseEvent ReleaseCapture ChangeWindowMessageFilterEx SetCapture MonitorFromRect ScreenToClient GetMenu RedrawWindow SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW GetMonitorInfoW IsProcessDPIAware InvalidateRgn SetWindowPos GetKeyState GetAsyncKeyState GetKeyboardState PeekMessageW RegisterClassExW MonitorFromPoint GetDC GetWindowLongPtrW RemovePropW ReleaseDC FlashWindowEx MonitorFromWindow SendInput MapVirtualKeyW SetWindowDisplayAffinity SetWindowTextW SetCursorPos PostMessageW RegisterWindowMessageA CreateIconFromResourceEx IsIconic GetClientRect SendMessageW GetSystemMetrics GetActiveWindow ChangeWindowMessageFilter GetPropW SetPropW DefWindowProcW CallWindowProcW ClientToScreen OpenClipboard SetWindowLongPtrW

ws2_32

WSAStartup WSAGetLastError WSAIoctl connect WSACleanup getsockopt accept getsockname WSASend send listen bind closesocket ioctlsocket WSASocketW setsockopt select shutdown recv WSARecv getpeername freeaddrinfo WSADuplicateSocketW getaddrinfo

uiautomationcore

UiaRaiseAutomationEvent UiaLookupId UiaGetReservedNotSupportedValue UiaRaiseAutomationPropertyChangedEvent UiaHostProviderFromHwnd UiaReturnRawElementProvider

gdi32

SetTextColor CreateCompatibleDC DeleteObject SetBkMode CreateDIBSection ChoosePixelFormat SelectObject DeleteDC GetDeviceCaps CreateRectRgn SwapBuffers SetPixelFormat CreateSolidBrush DescribePixelFormat

advapi32

RevertToSelf RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW SystemFunction036 ImpersonateAnonymousToken

shlwapi

AssocQueryStringW

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc

oleaut32

SysStringLen SysFreeString SysAllocStringLen GetErrorInfo SafeArrayPutElement SetErrorInfo SafeArrayCreateVector

uxtheme

SetWindowTheme

ole32

CoInitializeEx CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

opengl32

wglDeleteContext wglMakeCurrent wglGetProcAddress wglCreateContext wglShareLists wglGetCurrentContext wglGetCurrentDC

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmGetCompositionStringW ImmSetCandidateWindow ImmSetCompositionWindow ImmAssociateContextEx ImmGetContext ImmReleaseContext

vcruntime140

__C_specific_handler __current_exception_context __current_exception __CxxFrameHandler3 memset memcmp memcpy memmove

api-ms-win-crt-math-l1-1-0

log2 roundf acosf cosf expf _hypotf floorf atan2f cbrtf exp2f sinf ceil pow cos sin round ceilf powf __setusermatherr floor trunc

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initterm_e _set_app_type _seh_filter_exe _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _initialize_onexit_table terminate _initterm _register_onexit_function exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_c3a8acc3845dada4d0f14e53a9bc34ae_akira_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_rusty-stealer_satacom_stealc

PE Signature issue

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

shell32

user32

ws2_32

uiautomationcore

gdi32

advapi32

shlwapi

comctl32

oleaut32

uxtheme

ole32

bcryptprimitives

bcrypt

opengl32

dwmapi

imm32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic