2026-09-07_80980a7c53d98cd48f9843a929cf1fab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_80980a7c53d98cd48f9843a929cf1fab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.9MB
Sample260908-12c4cshm21
SHA256 c2b5980f1139fd98d1979ab494648c8d9438968eecee3af1b389cc9c8a538b1f
MD5 80980a7c53d98cd48f9843a929cf1fab
SHA1 7e93fa9162428dbbdc3d05d052ea8b4bdac0eb21
SHA512 1a2035b175debe6b20c8f2d23a146502b4a56639659840558201c2be70cff60d01c5c198b2d121a9a5e4a544f83240875501dc9384a14be81c2af74328d6328b
SSDEEP 49152:wRosnw0zOF6tjG8g7rq9UtiGXVI5g/mVD5nbwz:ozZarZiGXVI5g/mVtnbM
TLSH
T1CB958E47B3A801FCC1A7C178C9165A0BEBB27815177197DF15A0CA6A6F23EE11B7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_80980a7c53d98cd48f9843a929cf1fab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-07_80980a7c53d98cd48f9843a929cf1fab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-09-07_80980a7c53d98cd48f9843a929cf1fab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 522509160b6e47931f410ba73814bfb0
SHA256 c2b5980f1139fd98d1979ab494648c8d9438968eecee3af1b389cc9c8a538b1f
MD5 80980a7c53d98cd48f9843a929cf1fab
SHA1 7e93fa9162428dbbdc3d05d052ea8b4bdac0eb21
SHA512 1a2035b175debe6b20c8f2d23a146502b4a56639659840558201c2be70cff60d01c5c198b2d121a9a5e4a544f83240875501dc9384a14be81c2af74328d6328b
SSDEEP 49152:wRosnw0zOF6tjG8g7rq9UtiGXVI5g/mVD5nbwz:ozZarZiGXVI5g/mVtnbM
TLSH
T1CB958E47B3A801FCC1A7C178C9165A0BEBB27815177197DF15A0CA6A6F23EE11B7E324
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1370524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Dev\Project New\Curl Test\x64\Release\Curl Test.pdb

crypt32

CertOpenStore CertEnumCertificatesInStore CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertCloseStore CertAddCertificateContextToStore CertGetNameStringA CertFindExtension

advapi32

CryptEncrypt CryptDestroyKey RegOpenKeyExW RegSetValueExW RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptImportKey

user32

CloseClipboard GetClipboardData OpenClipboard

bcrypt

BCryptGenRandom

kernel32

SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx SetEvent CreateEventA QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA SetLastError MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GetLocaleInfoEx GetCurrentDirectoryW LeaveCriticalSection FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle GetModuleHandleW GetFileInformationByHandleEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW IsValidCodePage SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc CreateProcessW GetExitCodeProcess GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI GlobalUnlock WideCharToMultiByte GlobalLock Sleep MultiByteToWideChar GetModuleFileNameW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW InitializeCriticalSection CreateDirectoryW RtlUnwind

normaliz

IdnToAscii IdnToUnicode

ws2_32

listen htonl getsockname connect bind recv select __WSAFDIsSet socket htons WSAIoctl setsockopt WSACleanup WSAStartup ntohs WSAGetLastError WSASetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt getaddrinfo freeaddrinfo recvfrom sendto gethostname ioctlsocket getpeername accept

wldap32

ord26 ord22 ord41 ord50 ord27 ord60 ord211 ord46 ord217 ord143 ord32 ord33 ord79 ord35 ord30 ord200 ord301 ord45

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_80980a7c53d98cd48f9843a929cf1fab_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

crypt32

advapi32

user32

bcrypt

kernel32

normaliz

ws2_32

wldap32

generic