2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.9MB
Sample260910-eggedswgnb
SHA256 e33ea8712914941f32f821d26687accccaa75f1171e66d5f7e0412a9707cb063
MD5 9a4071f71d130aeae9c957a992a8f72a
SHA1 9812d95a4f012678c5714413c9bacd419f4be48b
SHA512 c0d168d4f4ba1c409ec78193b07bcbf0874946058f4f3b1169948bf4f95f26a361e37ca95ebca424e640d8f88e03d2214b6927bd572466d7283ec8d9385fda45
SSDEEP 49152:ROAeQDh2Y6yr1fKjffYUAkiiQ72H8s+GpHsIex4x8EVep:oFUKjffYUAkiiQ72csPSix8EVy
TLSH
T10595BF1663A801F8D1ABD178C546560BE7B2B445132197CF07B88BAA2F63BF25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 9754b21a20c835a2ab949ad76e6ac3ee
SHA256 e33ea8712914941f32f821d26687accccaa75f1171e66d5f7e0412a9707cb063
MD5 9a4071f71d130aeae9c957a992a8f72a
SHA1 9812d95a4f012678c5714413c9bacd419f4be48b
SHA512 c0d168d4f4ba1c409ec78193b07bcbf0874946058f4f3b1169948bf4f95f26a361e37ca95ebca424e640d8f88e03d2214b6927bd572466d7283ec8d9385fda45
SSDEEP 49152:ROAeQDh2Y6yr1fKjffYUAkiiQ72H8s+GpHsIex4x8EVep:oFUKjffYUAkiiQ72csPSix8EVy
TLSH
T10595BF1663A801F8D1ABD178C546560BE7B2B445132197CF07B88BAA2F63BF25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

823568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nvrla.pdb

kernel32

QueryPerformanceCounter AllocConsole CreateFileW CreateDirectoryW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary GetProcAddress GetFileAttributesW GetFullPathNameW SetLastError GetSystemDirectoryW GetModuleFileNameW GetModuleHandleW LoadLibraryExW FileTimeToSystemTime HeapSize WriteConsoleW DeleteFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP VerifyVersionInfoW IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetCurrentDirectoryW SetEndOfFile VerSetConditionMask HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode GetACP GetCurrentProcessId SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx InitializeSListHead LocalFree ResetEvent CloseHandle SetEvent AttachConsole GetLastError CreateEventW LocalAlloc WaitForSingleObject WaitForMultipleObjects SetConsoleTitleA GetCommandLineW SetDefaultDllDirectories GetModuleFileNameA Sleep SetStdHandle OutputDebugStringA ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency FormatMessageW SleepEx GetTickCount MoveFileExA WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetModuleHandleA MultiByteToWideChar GetStdHandle GetFileType ReadFile PeekNamedPipe CreateFileA GetFileSizeEx RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentThreadId GetExitCodeThread WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RtlUnwind

ole32

CoTaskMemFree

ws2_32

ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl gethostname __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt select

secur32

InitSecurityInterfaceA

iphlpapi

if_nametoindex

wldap32

ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord30 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord301 ord200 ord41

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

Name

.text

Size

1022KB

Virtual Size

1021KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_9a4071f71d130aeae9c957a992a8f72a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

ole32

ws2_32

secur32

iphlpapi

wldap32

crypt32

generic