2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.9MB
Sample260910-fx9ljs1wev
SHA256 ce1ea25181ada082a02e10a2ca1b09151b7c86bf5595253b8f2a852d709ef816
MD5 63c5d387b9f954eb60dd155d94f3e75b
SHA1 4e498e364ebe4055810296a46be9f20be926c7c9
SHA512 1846d59335b91cb19ec5ae67571458dcf93d646eb85e1fea5cb3e16c1d9eb1c1cd43710d00f8ba205fe27ffbf477e013c16f178aef683336ce7e7bacc216644d
SSDEEP 49152:S+AeQDh2Y6yr1fKjffYUAkiiQ72H8s+GpHs8ix4x8EVep:RFUKjffYUAkiiQ72csPaix8EVy
TLSH
T11395BF1663A801F8D1ABD178C546560BE7B2B445133197CF07B88BAA2F63BE25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 9754b21a20c835a2ab949ad76e6ac3ee
SHA256 ce1ea25181ada082a02e10a2ca1b09151b7c86bf5595253b8f2a852d709ef816
MD5 63c5d387b9f954eb60dd155d94f3e75b
SHA1 4e498e364ebe4055810296a46be9f20be926c7c9
SHA512 1846d59335b91cb19ec5ae67571458dcf93d646eb85e1fea5cb3e16c1d9eb1c1cd43710d00f8ba205fe27ffbf477e013c16f178aef683336ce7e7bacc216644d
SSDEEP 49152:S+AeQDh2Y6yr1fKjffYUAkiiQ72H8s+GpHs8ix4x8EVep:RFUKjffYUAkiiQ72csPaix8EVy
TLSH
T11395BF1663A801F8D1ABD178C546560BE7B2B445133197CF07B88BAA2F63BE25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

823568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nvrla.pdb

kernel32

QueryPerformanceCounter AllocConsole CreateFileW CreateDirectoryW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary GetProcAddress GetFileAttributesW GetFullPathNameW SetLastError GetSystemDirectoryW GetModuleFileNameW GetModuleHandleW LoadLibraryExW FileTimeToSystemTime HeapSize WriteConsoleW DeleteFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP VerifyVersionInfoW IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetCurrentDirectoryW SetEndOfFile VerSetConditionMask HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode GetACP GetCurrentProcessId SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx InitializeSListHead LocalFree ResetEvent CloseHandle SetEvent AttachConsole GetLastError CreateEventW LocalAlloc WaitForSingleObject WaitForMultipleObjects SetConsoleTitleA GetCommandLineW SetDefaultDllDirectories GetModuleFileNameA Sleep SetStdHandle OutputDebugStringA ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency FormatMessageW SleepEx GetTickCount MoveFileExA WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetModuleHandleA MultiByteToWideChar GetStdHandle GetFileType ReadFile PeekNamedPipe CreateFileA GetFileSizeEx RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentThreadId GetExitCodeThread WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RtlUnwind

ole32

CoTaskMemFree

ws2_32

ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl gethostname __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt select

secur32

InitSecurityInterfaceA

iphlpapi

if_nametoindex

wldap32

ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord30 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord301 ord200 ord41

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

Name

.text

Size

1022KB

Virtual Size

1021KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_63c5d387b9f954eb60dd155d94f3e75b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

ole32

ws2_32

secur32

iphlpapi

wldap32

crypt32

generic