2026-08-20_d715805c56594ddffd8af086a4ea48ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_d715805c56594ddffd8af086a4ea48ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 2.8MB
Sample260820-nd39esch67
SHA256 5468cc685320e3daff2f834b49fef25f2ed660f87b76897e73634b256baceb94
MD5 d715805c56594ddffd8af086a4ea48ed
SHA1 baa1317b5ab71dbca41e162248dd94a7559336f6
SHA512 264c1866574d5535fd879717ad3b0646ecc10747aafd12c681ce9ad0951acb00aabeb492de869afa17b26ddfa8cc44207f18c36ec7ba1908e2f8b9f3907d698d
SSDEEP 49152:xN36R7KTYIlXr9iQNGxx94xv8lqO6rdVra3vjtAAAttWpbxhn0neFuSfjGsPxs45:xB65cNGxx94xv8lqO6pVra/jtAAywx8h
TLSH
T129D5CF11E3A201A8C16BA1B8E83F875BC670B0192761D2CF33D84A752FA75D09E7E7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_d715805c56594ddffd8af086a4ea48ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-20_d715805c56594ddffd8af086a4ea48ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 2.8MB

2026-08-20_d715805c56594ddffd8af086a4ea48ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 673df9b23dc2960d2bc7da9b2d2b9a07
SHA256 5468cc685320e3daff2f834b49fef25f2ed660f87b76897e73634b256baceb94
MD5 d715805c56594ddffd8af086a4ea48ed
SHA1 baa1317b5ab71dbca41e162248dd94a7559336f6
SHA512 264c1866574d5535fd879717ad3b0646ecc10747aafd12c681ce9ad0951acb00aabeb492de869afa17b26ddfa8cc44207f18c36ec7ba1908e2f8b9f3907d698d
SSDEEP 49152:xN36R7KTYIlXr9iQNGxx94xv8lqO6rdVra3vjtAAAttWpbxhn0neFuSfjGsPxs45:xB65cNGxx94xv8lqO6pVra/jtAAywx8h
TLSH
T129D5CF11E3A201A8C16BA1B8E83F875BC670B0192761D2CF33D84A752FA75D09E7E7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

997556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ty\Downloads\ui\imgui-features-shadow\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

user32

SetCursor GetClientRect SetCapture LoadCursorW GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetKeyState UpdateWindow PostQuitMessage IsWindowUnicode TranslateMessage SetLayeredWindowAttributes UnhookWindowsHookEx MoveWindow BlockInput MessageBoxA PeekMessageW SetWindowLongA DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW MessageBoxW DestroyWindow GetWindowRect DefWindowProcW GetWindowLongW SetWindowsHookExW SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData ReleaseCapture SetClipboardData

kernel32

GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GetLogicalDrives FindFirstFileW FindNextFileW WriteFile RemoveDirectoryW FindClose WaitForSingleObject CreateFileW Sleep GetLastError DeleteFileW CloseHandle Beep CreateProcessW GetModuleHandleW CreateProcessA GetExitCodeProcess DecodePointer AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess CreateThread VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW QueryFullProcessImageNameW SetLastError QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx GetSystemInfo VirtualAlloc GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW GetFileSizeEx GlobalFree SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte FormatMessageW GlobalAlloc MultiByteToWideChar InitializeCriticalSectionAndSpinCount TlsAlloc RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW GetCPInfo GetStringTypeW LCMapStringEx EncodePointer TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW WriteConsoleW ExitProcess ExitThread FreeLibraryAndExitThread DuplicateHandle VirtualQuery GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx GetConsoleMode ReadConsoleW RtlUnwind GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers CreatePipe GetTimeZoneInformation SetStdHandle SetEndOfFile IsValidCodePage GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx TryAcquireSRWLockExclusive FormatMessageA GlobalLock GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WakeAllConditionVariable

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

urlmon

URLDownloadToFileA

wininet

InternetReadFile InternetOpenW InternetCloseHandle InternetOpenUrlA

advapi32

SystemFunction036 OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CopySid CryptImportKey CryptEncrypt

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptDecodeObjectEx

ws2_32

WSACreateEvent WSAEnumNetworkEvents send WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop WSAStartup WSACleanup bind getsockopt getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname WSACloseEvent connect

shell32

ShellExecuteA

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_d715805c56594ddffd8af086a4ea48ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

d3d11

d3dcompiler_43

user32

kernel32

imm32

dwmapi

d3dx11_43

urlmon

wininet

advapi32

crypt32

ws2_32

shell32

shlwapi

psapi

userenv

bcrypt

generic