General
- Target 2026-08-19_ce1558b9114a4d07826350d79d19bd69_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 15.9MB
- Sample260819-ex92mswfnh
- SHA256 9a2aae3268e0dd2d8ab562b74eff8c55136871017d381ebcbe5c706b42f300e4
- MD5 ce1558b9114a4d07826350d79d19bd69
- SHA1 544863e3b82df6a1f8ba6d4c1e464a59fbb1f4d0
- SHA512 030301b5ba91f45d556bb88b2ac67654f56361281079d2425496b8dd392e9606ade5d3a46fce5021058cf2f4ce037585d9eb86781f86ea7aefb257692ff1b528
- SSDEEP 393216:72LYKd1QLd9tByxjhIHqiK1piXLGVEceeKxXms57wYKZCro:T4urtAjFDiXHNeKYNCro
- TLSH T139F63301EA9019AAF9FF1E75C4CAE019C93779E60BB1D39F036C62641AA70E54C71B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-19_ce1558b9114a4d07826350d79d19bd69_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_ce1558b9114a4d07826350d79d19bd69_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_ce1558b9114a4d07826350d79d19bd69_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 15.9MB
- SHA256 9a2aae3268e0dd2d8ab562b74eff8c55136871017d381ebcbe5c706b42f300e4
- MD5 ce1558b9114a4d07826350d79d19bd69
- SHA1 544863e3b82df6a1f8ba6d4c1e464a59fbb1f4d0
- SHA512 030301b5ba91f45d556bb88b2ac67654f56361281079d2425496b8dd392e9606ade5d3a46fce5021058cf2f4ce037585d9eb86781f86ea7aefb257692ff1b528
- SSDEEP 393216:72LYKd1QLd9tByxjhIHqiK1piXLGVEceeKxXms57wYKZCro:T4urtAjFDiXHNeKYNCro
- TLSH T139F63301EA9019AAF9FF1E75C4CAE019C93779E60BB1D39F036C62641AA70E54C71B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.