2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.9MB
Sample260910-11btxayxfw
SHA256 f6f58a36e2bb6fdfe332e57d68f24046c785ae06917e2467fc6cf08d0ac786c5
MD5 eb6eb604ab4b25bbed2fde136408eefb
SHA1 cbf66e0f2945515f20dd2ede04d0b27e5a6358fd
SHA512 6000085dfc393c3796d8c8dfb33ed71e2030ad10ba6e9c1c92db289c4da49e2a495c347fa5ed464534c351087b0c808d2d2a20da66b92d75114a5f5b10fc384d
SSDEEP 49152:TOAeQDh2Y6yr1fKjffYUAkiiQ72t8s+GpHsIwDmg27RnWGj:CFUKjffYUAkiiQ72usPED527BWG
TLSH
T18795BF1A63A801F9D1ABD178C546960BE7B27405132197CF07B88BAA2F63BF15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 9754b21a20c835a2ab949ad76e6ac3ee
SHA256 f6f58a36e2bb6fdfe332e57d68f24046c785ae06917e2467fc6cf08d0ac786c5
MD5 eb6eb604ab4b25bbed2fde136408eefb
SHA1 cbf66e0f2945515f20dd2ede04d0b27e5a6358fd
SHA512 6000085dfc393c3796d8c8dfb33ed71e2030ad10ba6e9c1c92db289c4da49e2a495c347fa5ed464534c351087b0c808d2d2a20da66b92d75114a5f5b10fc384d
SSDEEP 49152:TOAeQDh2Y6yr1fKjffYUAkiiQ72t8s+GpHsIwDmg27RnWGj:CFUKjffYUAkiiQ72usPED527BWG
TLSH
T18795BF1A63A801F9D1ABD178C546960BE7B27405132197CF07B88BAA2F63BF15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

823568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nvrla.pdb

kernel32

QueryPerformanceCounter AllocConsole CreateFileW CreateDirectoryW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary GetProcAddress GetFileAttributesW GetFullPathNameW SetLastError GetSystemDirectoryW GetModuleFileNameW GetModuleHandleW LoadLibraryExW FileTimeToSystemTime HeapSize WriteConsoleW DeleteFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP VerifyVersionInfoW IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetCurrentDirectoryW SetEndOfFile VerSetConditionMask HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode GetACP GetCurrentProcessId SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx InitializeSListHead LocalFree ResetEvent CloseHandle SetEvent AttachConsole GetLastError CreateEventW LocalAlloc WaitForSingleObject WaitForMultipleObjects SetConsoleTitleA GetCommandLineW SetDefaultDllDirectories GetModuleFileNameA Sleep SetStdHandle OutputDebugStringA ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency FormatMessageW SleepEx GetTickCount MoveFileExA WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetModuleHandleA MultiByteToWideChar GetStdHandle GetFileType ReadFile PeekNamedPipe CreateFileA GetFileSizeEx RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentThreadId GetExitCodeThread WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RtlUnwind

ole32

CoTaskMemFree

ws2_32

ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl gethostname __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt select

secur32

InitSecurityInterfaceA

iphlpapi

if_nametoindex

wldap32

ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord30 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord301 ord200 ord41

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

Name

.text

Size

1022KB

Virtual Size

1021KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_eb6eb604ab4b25bbed2fde136408eefb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

ole32

ws2_32

secur32

iphlpapi

wldap32

crypt32

generic