2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 4.2MB
Sample260816-vrf5dasfmf
SHA256 dae22689d58dc0d6817a6d91ff0fb0d5fe07d447ec2ed2d80e041fbc763ed715
MD5 a69b747d639b5cce41de342dc2a5d934
SHA1 c0fcd39cc406b72664592886447a7e0d5d2195d4
SHA512 1eba7c1a80ea76ba286077e30579dd1c1104085e30f75fc91b8125f7e026cc9db6b8e3fb46c52c108746c1d8d5cf92a025853a08d3a32def3d1beb8ed7e0da39
SSDEEP 49152:NGtlq1aVwASOz5IU6iCaW8SyrZ12B+fti1oYvJWYWQaIhfCj89zd6hfKH6Tql8Bn:0++LHz1i1oYJvJC8q2VhkbbmBYtH
TLSH
T13C269D16665901FCD5B7D138C6CA5627E7B17C0603B18BCB02E4BA661F33AE26E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.2MB

2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 3f4b1e71518846c3ef9fb98f74128737
SHA256 dae22689d58dc0d6817a6d91ff0fb0d5fe07d447ec2ed2d80e041fbc763ed715
MD5 a69b747d639b5cce41de342dc2a5d934
SHA1 c0fcd39cc406b72664592886447a7e0d5d2195d4
SHA512 1eba7c1a80ea76ba286077e30579dd1c1104085e30f75fc91b8125f7e026cc9db6b8e3fb46c52c108746c1d8d5cf92a025853a08d3a32def3d1beb8ed7e0da39
SSDEEP 49152:NGtlq1aVwASOz5IU6iCaW8SyrZ12B+fti1oYvJWYWQaIhfCj89zd6hfKH6Tql8Bn:0++LHz1i1oYJvJC8q2VhkbbmBYtH
TLSH
T13C269D16665901FCD5B7D138C6CA5627E7B17C0603B18BCB02E4BA661F33AE26E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2379100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\steamUI\gamestream\secure_desktop_capture\win64\Release\secure_desktop_capture.pdb

kernel32

GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalAlloc LocalFree MultiByteToWideChar SetLastError OutputDebugStringA WriteConsoleW FreeEnvironmentStringsW GetModuleHandleA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetFilePointerEx SetStdHandle LCMapStringW CompareStringW HeapValidate HeapSize SetConsoleCtrlHandler GetModuleHandleExW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe IsProcessorFeaturePresent UnhandledExceptionFilter RtlCaptureContext GetModuleFileNameW FreeLibrary GetCurrentProcessId GetEnvironmentStringsW Sleep WriteFile GetFullPathNameW FindFirstFileW FindClose CreateFileW Process32Next Process32First CreateToolhelp32Snapshot CreateFileMappingA UnmapViewOfFile MapViewOfFile OpenProcess GetCurrentProcess CreateEventA WaitForSingleObject ResetEvent SetEvent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader InitializeSListHead GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLastError CloseHandle LeaveCriticalSection ExitProcess EnterCriticalSection SetEndOfFile ReadFile GetFileSizeEx GetFileInformationByHandle GetCurrentDirectoryW FindNextFileW WideCharToMultiByte RtlVirtualUnwind InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetEnvironmentVariableW GetFileType GetModuleHandleW DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime IsDebuggerPresent TerminateProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW GlobalMemoryStatusEx VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameA GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation QueryPerformanceFrequency DuplicateHandle RaiseException TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread GetExitCodeThread SetUnhandledExceptionFilter LoadLibraryExA LoadLibraryExW LoadLibraryW DebugBreak GetProcessHeaps SetEnvironmentVariableW FindFirstFileExW FlushFileBuffers GetDriveTypeW RtlUnwind

user32

SetDlgItemInt GetDlgItem EndDialog SetDlgItemTextA CloseClipboard SetClipboardData EmptyClipboard GetDesktopWindow CloseDesktop GetDlgItemInt OpenClipboard OpenDesktopA GetWindowTextLengthA DialogBoxParamA GetWindowThreadProcessId EnumWindows GetShellWindow GetWindowRect IsWindowVisible ReleaseDC GetDC GetCursorInfo LoadCursorA GetCursorPos MessageBoxA GetSystemMetrics SendInput GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfA SetWindowPos

gdi32

GdiFlush SetBrushOrgEx CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC BitBlt

advapi32

RegSetValueExA RegisterEventSourceW DeregisterEventSource OpenProcessToken AddAccessAllowedAce RegDeleteTreeA ReportEventW RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid CreateWellKnownSid CopySid

shell32

CommandLineToArgvW

psapi

GetProcessMemoryInfo

bcrypt

BCryptGenRandom

ws2_32

WSASetLastError recv closesocket send WSACleanup WSAGetLastError

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

766KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_a69b747d639b5cce41de342dc2a5d934_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

psapi

bcrypt

ws2_32

generic