2026-08-19_f88b040a77a85ed9819cec3f2c4569e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_f88b040a77a85ed9819cec3f2c4569e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 11.8MB
Sample260819-ea546scg76
SHA256 531e18a1a3dd4b3b7394d08c14fb4a6e1ab7bdb599e5d6d95e9b0d5877998552
MD5 f88b040a77a85ed9819cec3f2c4569e1
SHA1 a42daa3e33e35eb077b3d56d2d57d4c2d4368a5d
SHA512 2b091bb749227f5689c5a8f7b818893335cf091b19b03fb49d5b461c0d1b3c789dfacb6509136f5fb6044194958ccc2b7e43131704f5e4bb67c66dddac41e612
SSDEEP 196608:EqmiBBeUgOrUzo4Q1s8kaPCdOjHyA3kfz2Sa4ggTkJ3gSyYxkNUyWqM5z486EHiZ:EqxTOMGRAqF
TLSH
T15DC67B4572A5C0D9E56BC038C25AA6FBE2713C45CB5086CB5AE07E6C3F73AD41ABB311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_f88b040a77a85ed9819cec3f2c4569e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-19_f88b040a77a85ed9819cec3f2c4569e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 11.8MB

2026-08-19_f88b040a77a85ed9819cec3f2c4569e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH bebd143050ccf80dc3870f2e269ae454
SHA256 531e18a1a3dd4b3b7394d08c14fb4a6e1ab7bdb599e5d6d95e9b0d5877998552
MD5 f88b040a77a85ed9819cec3f2c4569e1
SHA1 a42daa3e33e35eb077b3d56d2d57d4c2d4368a5d
SHA512 2b091bb749227f5689c5a8f7b818893335cf091b19b03fb49d5b461c0d1b3c789dfacb6509136f5fb6044194958ccc2b7e43131704f5e4bb67c66dddac41e612
SSDEEP 196608:EqmiBBeUgOrUzo4Q1s8kaPCdOjHyA3kfz2Sa4ggTkJ3gSyYxkNUyWqM5z486EHiZ:EqxTOMGRAqF
TLSH
T15DC67B4572A5C0D9E56BC038C25AA6FBE2713C45CB5086CB5AE07E6C3F73AD41ABB311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8574272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\GameMaker\GameMaker\GameMaker\Runner\VC_Runner\x64\Release-Zeus\Runner.pdb

rpcrt4

UuidToStringW UuidCreate

wininet

HttpEndRequestW InternetWriteFile InternetCloseHandle HttpSendRequestA InternetCrackUrlA InternetCanonicalizeUrlA HttpOpenRequestA HttpQueryInfoA InternetOpenA InternetConnectA InternetReadFile InternetGetConnectedState

d3d11

D3D11CreateDevice

dbghelp

MiniDumpWriteDump SymInitialize SymFromAddr

winmm

joyGetPos mciSendStringA timeGetTime timeGetDevCaps timeEndPeriod timeBeginPeriod joyGetPosEx

ws2_32

WSAStartup WSAAddressToStringA inet_pton socket connect gethostname recvfrom recv getsockopt freeaddrinfo sendto ioctlsocket setsockopt WSAGetLastError getpeername inet_ntop getnameinfo __WSAFDIsSet select ntohl ntohs htonl htons getaddrinfo listen closesocket bind accept WSACleanup getsockname send

gdiplus

GdiplusStartup GdiplusShutdown

comctl32

InitCommonControlsEx

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

mfplat

MFStartup MFCreateSourceResolver MFCreateMediaType MFShutdown

mf

MFCreateAudioRendererActivate MFCreateTopologyNode MFCreateMediaSession MFCreateSampleGrabberSinkActivate MFGetService MFCreateTopology

iphlpapi

GetAdaptersAddresses NotifyIpInterfaceChange CancelMibChangeNotify2

kernel32

SetConsoleCtrlHandler GetCurrentThread WriteFile GetStdHandle FreeLibraryAndExitThread ExitThread PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindFirstFileExW MoveFileExW SetFileAttributesW GetFileAttributesExW GetModuleHandleExW HeapWalk HeapValidate RtlUnwind LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx GetTempPathW GetProcessHeap HeapFree HeapAlloc InitializeSListHead RaiseException GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetConsoleMode GetFileSizeEx TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry SetFilePointerEx ReadConsoleW SetStdHandle GetTimeZoneInformation HeapReAlloc IsValidLocale IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetDateFormatW GetTimeFormatW CompareStringW VirtualQuery Sleep LoadLibraryW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetLastError LoadLibraryA OutputDebugStringA SetWaitableTimer CreateWaitableTimerW CloseHandle GetConsoleWindow SetLastError GetFullPathNameW GetExitCodeThread FormatMessageW DeleteFileW CreateThread GetCurrentDirectoryW SetCurrentDirectoryW LocalFree GetModuleHandleW ReadFile SetFilePointer CreateFileW GetFileAttributesW GetCurrentDirectoryA SetCurrentDirectoryA SetEnvironmentVariableW FreeLibrary FormatMessageA CreateDirectoryW FindFirstFileW FindNextFileW RemoveDirectoryW GetModuleFileNameW GetUserDefaultLCID WaitForSingleObject ResumeThread GetTempPathA CreateProcessW CreateDirectoryA OpenThread GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcess K32GetProcessMemoryInfo GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoW GetVersionExW GetSystemInfo GlobalMemoryStatusEx VerSetConditionMask VerifyVersionInfoW GlobalFree GetCurrentProcessId DebugBreak GetEnvironmentVariableA ExitProcess lstrlenA GetVersion SetEnvironmentVariableA CreateFileMappingW MapViewOfFile MoveFileA GetCommandLineW ExpandEnvironmentStringsW GetFinalPathNameByHandleW SetErrorMode GetCurrentThreadId SetUnhandledExceptionFilter WaitForSingleObjectEx CreateEventExA OutputDebugStringW RtlCaptureContext CreateEventW ResetEvent SetEvent GetStringTypeW GetLocaleInfoEx GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer CreateSymbolicLinkW GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle GetNativeSystemInfo SwitchToThread SleepConditionVariableSRW SleepConditionVariableCS SetEndOfFile WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock TlsFree TlsGetValue TlsAlloc SetThreadPriority TlsSetValue DeleteCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection RtlCaptureStackBackTrace LCMapStringW EnumSystemLocalesW FlushFileBuffers FindClose GetConsoleOutputCP HeapSize GetFileSize WriteConsoleW

user32

MsgWaitForMultipleObjectsEx EnumDisplaySettingsA TranslateMessage SetProcessDPIAware SetDlgItemTextA MessageBoxA PeekMessageW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable keybd_event IsDialogMessageW DispatchMessageW GetFocus GetRawInputDeviceList GetCursorPos SetCursorPos UpdateWindow EnumDisplaySettingsW GetMonitorInfoW ShowWindow GetSystemMetrics SendMessageW GetAsyncKeyState IsWindowVisible GetWindowLongPtrW GetLayeredWindowAttributes IntersectRect SetWindowLongPtrW MonitorFromWindow wsprintfW GetActiveWindow ClientToScreen MoveWindow CreateDialogParamW GetDC EndDialog SetWindowTextW SetDlgItemTextW GetDlgItemTextW GetDlgItem DrawTextW DialogBoxParamW ReleaseDC GetWindowLongW DefWindowProcW GetKeyState PostMessageW CreateWindowExW ScreenToClient CallNextHookEx RegisterClassExW FindWindowExA MapWindowPoints UnhookWindowsHookEx EnumWindows SetFocus BringWindowToTop EnumDisplayDevicesW LoadCursorW SendMessageA SetParent SetCapture SetWindowsHookExW SetCursor GetClientRect PostThreadMessageW FindWindowA ReleaseCapture SetForegroundWindow LoadImageW MessageBoxW GetRawInputDeviceInfoA DestroyWindow AdjustWindowRectEx GetWindowRect SetWindowPos

gdi32

SelectObject DeleteObject CombineRgn GetRgnBox CreateRectRgnIndirect GetDeviceCaps GetStockObject

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegOpenKeyExW RegCloseKey CryptGenRandom CryptReleaseContext RegQueryValueExW CryptAcquireContextA

shell32

ShellExecuteW SHGetFolderPathW

ole32

CoInitialize CoTaskMemFree CoCreateInstance CoCreateFreeThreadedMarshaler PropVariantClear

dwmapi

DwmGetWindowAttribute DwmGetCompositionTimingInfo

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

432KB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

411KB

Virtual Size

411KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mydata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_f88b040a77a85ed9819cec3f2c4569e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

rpcrt4

wininet

d3d11

dbghelp

winmm

ws2_32

gdiplus

comctl32

version

mfplat

mf

iphlpapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

dwmapi

imm32

generic