2026-08-23_9074ad4c67edb9811c565aa878c7efb7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-08-23_9074ad4c67edb9811c565aa878c7efb7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.2MB
Sample260825-3fgkrsbb72
SHA256 b4a4f423711234d239b1442e7dbf1f442268af4841723fc5d931a88d181e8cb3
MD5 9074ad4c67edb9811c565aa878c7efb7
SHA1 fb3c9967882ee33458be060f20e60c3eff0324ba
SHA512 3717235c2aebfcb06bfd2e4325b0be892847da4fb95bf596f36f48482943387010d72de97c155804c3ce373b15f73062a16d7798ab6b8c526122d04fb1fae407
SSDEEP 49152:wp0pmCcNUzsLRKDHch7pmIfBCPlfZgWLBb7itsziLIdPeNvIkXemLNiXicJFFRGN:RCSitszdQNvkm7wRGpj3
TLSH
T1A3F5AE17A2D600F8DCB6C238C962C513D7B2B8051770ABDF06A496691FB3AF15E3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_9074ad4c67edb9811c565aa878c7efb7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-23_9074ad4c67edb9811c565aa878c7efb7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.2MB

2026-08-23_9074ad4c67edb9811c565aa878c7efb7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH b38edbf55e0c1b53a35c012c0c578358
SHA256 b4a4f423711234d239b1442e7dbf1f442268af4841723fc5d931a88d181e8cb3
MD5 9074ad4c67edb9811c565aa878c7efb7
SHA1 fb3c9967882ee33458be060f20e60c3eff0324ba
SHA512 3717235c2aebfcb06bfd2e4325b0be892847da4fb95bf596f36f48482943387010d72de97c155804c3ce373b15f73062a16d7798ab6b8c526122d04fb1fae407
SSDEEP 49152:wp0pmCcNUzsLRKDHch7pmIfBCPlfZgWLBb7itsziLIdPeNvIkXemLNiXicJFFRGN:RCSitszdQNvkm7wRGpj3
TLSH
T1A3F5AE17A2D600F8DCB6C238C962C513D7B2B8051770ABDF06A496691FB3AF15E3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1455100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB4_MbamBgNativeMsg\bin\x64\Release\MbamBgNativeMsg.pdb

kernel32

SetEvent Sleep SwitchToThread HeapAlloc HeapFree GetProcessHeap LocalFree CreateFileW CloseHandle DisconnectNamedPipe ResetEvent WaitForSingleObject WaitForSingleObjectEx CreateMutexA CreateEventW WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId CreateThread GlobalFree MultiByteToWideChar MoveFileExW CopyFileW WideCharToMultiByte SetFilePointer FlushFileBuffers GetFileSizeEx ReadFile WriteFile GetFileInformationByHandle OpenProcess GetProcAddress GetModuleHandleW LoadLibraryW FormatMessageW CallNamedPipeW CreateNamedPipeW ConnectNamedPipe GetOverlappedResult GetWindowsDirectoryW FreeLibrary FindNextFileW FindClose SetThreadPriority QueryDosDeviceW GetModuleFileNameW GetTickCount GetLocalTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation FileTimeToSystemTime FindFirstFileW GetFileAttributesW CreateDirectoryW RemoveDirectoryW LeaveCriticalSection GetVersionExW VerSetConditionMask VerifyVersionInfoW GetSystemInfo IsWow64Process GetNativeSystemInfo GetLogicalDriveStringsW GetFileSize GetDriveTypeW OutputDebugStringW GetCurrentThreadId SetLastError SetEndOfFile GetStdHandle GetModuleHandleA GetCurrentDirectoryW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount ReleaseMutex CreateMutexW TerminateProcess GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW SetEnvironmentVariableW GetFileType DeleteFiber QueryPerformanceCounter ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx GetLastError DeleteFileW DecodePointer RaiseException VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent GetStringTypeW QueryPerformanceFrequency EncodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx LoadLibraryExW ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler PeekNamedPipe FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP SetFilePointerEx SetStdHandle HeapReAlloc GetFullPathNameW HeapSize FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

835KB

Virtual Size

834KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_9074ad4c67edb9811c565aa878c7efb7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

generic