2026-09-16_abf4787121e3a095d7412ca5bdfdbd67_cobalt-strike_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_abf4787121e3a095d7412ca5bdfdbd67_cobalt-strike_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_vidar
Size 4.2MB
Sample260916-lyhgcasy7j
SHA256 eb20e7fb987db6cfb5c08ff37d60d03559e70b9e7c92315d034ba947db0d096d
MD5 abf4787121e3a095d7412ca5bdfdbd67
SHA1 8d7d5b4cafd73892668270482e5b25b4396323a9
SHA512 ccb554f8f965ea22d7464f3e3d0ece6e09299c3e38a8db551d9f5390fa61de0a6fdda02a41240efcd31523c9fbbbc2925e97119e4dbdf715ce2fc47d3da4cf7e
SSDEEP 98304:fs67v2qeIyUY4yu0tPgm+uwtPudIv9XW6rgx6QSakJByH:f57vreIRWggx6LS
TLSH
T17A268D56B26484A5D0ABC13C9A56E623D3317C055B506BCF92D0BE6B3F7BBE00D7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_abf4787121e3a095d7412ca5bdfdbd67_cobalt-strike_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_vidar

File Explorer

2026-09-16_abf4787121e3a095d7412ca5bdfdbd67_cobalt-strike_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_vidar

.exe 4.2MB

2026-09-16_abf4787121e3a095d7412ca5bdfdbd67_cobalt-strike_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_vidar

IMPHASH 65268e87191f38de00cbb3119fb6631a
SHA256 eb20e7fb987db6cfb5c08ff37d60d03559e70b9e7c92315d034ba947db0d096d
MD5 abf4787121e3a095d7412ca5bdfdbd67
SHA1 8d7d5b4cafd73892668270482e5b25b4396323a9
SHA512 ccb554f8f965ea22d7464f3e3d0ece6e09299c3e38a8db551d9f5390fa61de0a6fdda02a41240efcd31523c9fbbbc2925e97119e4dbdf715ce2fc47d3da4cf7e
SSDEEP 98304:fs67v2qeIyUY4yu0tPgm+uwtPudIv9XW6rgx6QSakJByH:f57vreIRWggx6LS
TLSH
T17A268D56B26484A5D0ABC13C9A56E623D3317C055B506BCF92D0BE6B3F7BBE00D7A321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

532680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryW GetProcAddress FreeLibrary SetLastError GetCommandLineW FindNextFileW GetCurrentProcess TerminateProcess GetModuleFileNameW FindClose GlobalFlags GetSystemInfo GetCurrentProcessId GetModuleHandleW IsBadReadPtr VirtualQuery HeapFree HeapReAlloc HeapAlloc GetProcessHeap ResetEvent GetSystemTimeAsFileTime VirtualProtect VirtualFree VirtualAlloc OpenFileMappingW UnmapViewOfFile LoadLibraryA CreateFileMappingW MapViewOfFile WriteConsoleW HeapSize CreateFileW FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType WriteFile GetStdHandle GetCommandLineA GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead QueryPerformanceCounter GetStartupInfoW ExitProcess FindResourceW LoadResource LockResource FreeResource GetCurrentThreadId SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc LeaveCriticalSection LocalFree FormatMessageW GetLastError IsDebuggerPresent DeleteCriticalSection GetUserDefaultLCID CreateEventW CloseHandle CreateThread SetEvent Sleep MultiByteToWideChar WideCharToMultiByte IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx TryEnterCriticalSection EnterCriticalSection InitializeCriticalSection

user32

GetPropW MessageBoxW GetMessageW TranslateMessage DispatchMessageW ReleaseDC GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW GetWindowLongPtrW SendMessageW MonitorFromWindow EnumWindows MessageBoxA GetWindowThreadProcessId wsprintfW

gdi32

SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GetDeviceCaps DeleteDC GetObjectW DeleteObject

ole32

CoUninitialize CoInitializeEx CreateStreamOnHGlobal

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

winhttp

WinHttpReadData WinHttpSendRequest WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpConnect WinHttpSetStatusCallback WinHttpReceiveResponse WinHttpOpenRequest WinHttpSetOption WinHttpCrackUrl WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpOpen

gdiplus

GdipCreateBitmapFromFile GdipDeleteGraphics GdipGetImageGraphicsContext GdipSetCompositingMode GdipCreateBitmapFromScan0 GdipGetImagePalette GdipGetImageWidth GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipGetImagePixelFormat GdipFree GdipBitmapLockBits

ws2_32

WSACleanup

Name

.text

Size

689KB

Virtual Size

689KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

211KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_abf4787121e3a095d7412ca5bdfdbd67_cobalt-strike_glassworm_icedid_luca-stealer_megazord_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

ole32

comctl32

winhttp

gdiplus

ws2_32

generic