2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
Size 462KB
Sample260822-312rfagg77
SHA256 0b91078ce5f197d5eada20886539a4309e9a27531eeab3e84f0e5d3935c75d4b
MD5 d015017802a1ab788422be9fe7ff3a17
SHA1 9e127a4794dccaf342107d38002411f4dd924508
SHA512 cbfe7af66110d3cae11d28d5de3cf6ad093e6a99c32aa9372c5d16e2427d9e85d973f6ea659e67362acd4b82677e84f71b072bcd35ae80347cf8430982ad3963
SSDEEP 6144:NJSwpI8qcj3yKOybyjUpbJgvTmF2QCK8ad2eT2V55VHBqiI:bIo27W9QQCK662V3Vhq
TLSH
T19DA47D26979401F9E0B7D278CE475D42EB71780A03B1AADF03D099B25F676E05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

.exe 462KB

2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 96576e97fe040d6a98595ed480697f5d
SHA256 0b91078ce5f197d5eada20886539a4309e9a27531eeab3e84f0e5d3935c75d4b
MD5 d015017802a1ab788422be9fe7ff3a17
SHA1 9e127a4794dccaf342107d38002411f4dd924508
SHA512 cbfe7af66110d3cae11d28d5de3cf6ad093e6a99c32aa9372c5d16e2427d9e85d973f6ea659e67362acd4b82677e84f71b072bcd35ae80347cf8430982ad3963
SSDEEP 6144:NJSwpI8qcj3yKOybyjUpbJgvTmF2QCK8ad2eT2V55VHBqiI:bIo27W9QQCK662V3Vhq
TLSH
T19DA47D26979401F9E0B7D278CE475D42EB71780A03B1AADF03D099B25F676E05E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket socket WSAStartup WSACleanup inet_pton htons connect

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest WinHttpReadData WinHttpSetOption WinHttpOpenRequest

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC SetTextColor SetBkMode SelectObject DeleteObject DeleteDC CreateSolidBrush CreateFontA

gdiplus

GdipDisposeImage GdipSaveImageToStream GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncoders

user32

TranslateMessage GetMessageA PostMessageA SendMessageA DefWindowProcA BlockInput EnumDisplayDevicesA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA FindWindowExA FindWindowA GetDesktopWindow FillRect SetCursorPos GetClientRect SetWindowTextA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow DispatchMessageA SetActiveWindow DrawTextA GetSystemMetrics SetTimer MapVirtualKeyA SendInput VkKeyScanA GetKeyNameTextA SetFocus BringWindowToTop SetWindowPos DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage

shell32

SHChangeNotify ShellExecuteA SHGetFolderPathA

advapi32

RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA CryptGenRandom CryptReleaseContext CryptAcquireContextA RegDeleteTreeA RegSetValueExA RegQueryValueExA GetUserNameA

ole32

GetHGlobalFromStream CreateStreamOnHGlobal

avicap32

capCreateCaptureWindowA

winmm

mciSendStringA

iphlpapi

GetAdaptersAddresses

kernel32

GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleMode SetFilePointerEx ReadConsoleW GetExitCodeProcess GetFileAttributesExW CreatePipe HeapReAlloc FindFirstFileExW FindNextFileW GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle IsValidCodePage GetModuleHandleExW CreateProcessW DuplicateHandle LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetModuleHandleW GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW GetSystemTimeAsFileTime WriteConsoleW SetEndOfFile GetModuleFileNameW GetCurrentProcessId ExpandEnvironmentStringsA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA GetFileSizeEx GetLogicalDrives ReadFile SetFilePointer WriteFile GetTempPathA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError WaitForSingleObject CreateMutexA Sleep GetCurrentProcess RtlUnwind ExitProcess CreateThread CreateRemoteThread CreateProcessA OpenProcess GlobalMemoryStatusEx GetSystemInfo GetLocalTime GetTickCount GetWindowsDirectoryA VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA GetProcAddress GlobalSize GlobalUnlock GlobalLock CopyFileA MoveFileExA GetComputerNameA WideCharToMultiByte FreeConsole CreateToolhelp32Snapshot Process32First Process32Next ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx

Name

.text

Size

336KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_d015017802a1ab788422be9fe7ff3a17_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

ws2_32

winhttp

bcrypt

gdi32

gdiplus

user32

shell32

advapi32

ole32

avicap32

winmm

iphlpapi

kernel32

generic