2026-08-23_e072ef12f8013f585f19e33a13ab16bf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_e072ef12f8013f585f19e33a13ab16bf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.7MB
Sample260823-wlqbjayflc
SHA256 de33cc8872a57675e865dba325c0ce1e3e37d52aad1a233229f997a4e04fc13c
MD5 e072ef12f8013f585f19e33a13ab16bf
SHA1 a268e5612639db7415c30f33fec537bd3fdff161
SHA512 a53e106c89c30e5547d95c3ca64ffb9d89fc2ef437e6687820a016d60d2f428216df87d3589e9b0aaabc2ffc3151c2c3ce41b40b848ccf65aa29446706b20c40
SSDEEP 49152:wg8zMSODRQ7MtZglJKfkYMTCm0778n+O93+xXjS222HOOnvHvd:P8zSmlscw7sruHH
TLSH
T11F064AC7A6BD00E0F1BACB3A9562A116F9BA3C57C37197DB778036160B727D0593AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_e072ef12f8013f585f19e33a13ab16bf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-23_e072ef12f8013f585f19e33a13ab16bf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.7MB

2026-08-23_e072ef12f8013f585f19e33a13ab16bf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 113cd5c7ead730c72f9335db5b01df56
SHA256 de33cc8872a57675e865dba325c0ce1e3e37d52aad1a233229f997a4e04fc13c
MD5 e072ef12f8013f585f19e33a13ab16bf
SHA1 a268e5612639db7415c30f33fec537bd3fdff161
SHA512 a53e106c89c30e5547d95c3ca64ffb9d89fc2ef437e6687820a016d60d2f428216df87d3589e9b0aaabc2ffc3151c2c3ce41b40b848ccf65aa29446706b20c40
SSDEEP 49152:wg8zMSODRQ7MtZglJKfkYMTCm0778n+O93+xXjS222HOOnvHvd:P8zSmlscw7sruHH
TLSH
T11F064AC7A6BD00E0F1BACB3A9562A116F9BA3C57C37197DB778036160B727D0593AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3836411

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\xnzero.loader-master\x64\Release\xnzero.loader.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency LoadLibraryA VerifyVersionInfoW DeleteFileW ReadFile WriteFile DecodePointer Beep GetLastError HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection Sleep VirtualAlloc VirtualFree FreeLibrary LoadLibraryExA LoadLibraryW DeleteFileA IsDebuggerPresent TerminateProcess CreateThread GetTickCount VirtualProtectEx GetTempPathA GetCurrentProcessId RaiseException SetUnhandledExceptionFilter VerSetConditionMask WideCharToMultiByte SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage MultiByteToWideChar GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FreeLibraryAndExitThread ExitThread WriteConsoleW GetFileType GetStdHandle RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc LoadLibraryExW GetModuleFileNameW InterlockedPushEntrySList RtlUnwindEx OutputDebugStringW VirtualQuery GetStartupInfoW UnhandledExceptionFilter InitializeSListHead CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GlobalFree GlobalLock GlobalUnlock GlobalAlloc DeviceIoControl CreateFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetModuleFileNameExA GetProcAddress GetModuleHandleA OpenProcess GetCurrentThread GetCPInfo GetStringTypeW GetSystemTimeAsFileTime GetCurrentProcess WakeConditionVariable InitializeConditionVariable FlsFree CloseHandle WriteProcessMemory ExitProcess FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer LeaveCriticalSection EnterCriticalSection TryAcquireSRWLockExclusive InitializeSRWLock SetLastError FormatMessageA WaitForSingleObjectEx GetCurrentThreadId LocalFree GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW AreFileApisANSI GetModuleHandleW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent GetModuleHandleExW

user32

GetWindowTextA EnumWindows GetWindowThreadProcessId GetWindow OpenClipboard CloseClipboard DefWindowProcA UnregisterClassA RegisterClassExA SetClipboardData EmptyClipboard IsChild DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos IsIconic BringWindowToTop SetFocus GetKeyState GetCapture SetCapture IsWindowVisible CreateWindowExA SetWindowLongW ReleaseCapture UpdateWindow PostQuitMessage PeekMessageA DispatchMessageA TranslateMessage UnhookWindowsHookEx SetWindowsHookExA FindWindowA EnumDisplayMonitors GetMonitorInfoA MonitorFromWindow LoadCursorA GetForegroundWindow SetWindowLongA GetWindowLongW WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW ReleaseDC GetDC SetForegroundWindow GetClipboardData

gdi32

GetDeviceCaps

advapi32

RegCloseKey RegCreateKeyA RegDeleteKeyA RegSetValueExA RegCreateKeyExA RegQueryValueExA RegSetKeyValueA RegOpenKeyA

shell32

ShellExecuteA ShellExecuteW

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd VMProtectDecryptStringA VMProtectBeginMutation VMProtectBeginVirtualization VMProtectIsProtected VMProtectIsDebuggerPresent VMProtectIsVirtualMachinePresent VMProtectIsValidImageCRC

wininet

InternetOpenW

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

xinput1_3

ord4 ord2

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

ntdll

RtlInitUnicodeString RtlPcToFileHeader RtlImageNtHeader RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext NtQuerySystemInformation

d3d9

Direct3DCreate9

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

851KB

Virtual Size

851KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.nsa

Size

128KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_e072ef12f8013f585f19e33a13ab16bf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

shell32

vmprotectsdk64

wininet

d3dx9_43

xinput1_3

imm32

ntdll

d3d9

generic