2026-09-19_c18d4a6d35d95bdbf19d97829e6a9552_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-09-19_c18d4a6d35d95bdbf19d97829e6a9552_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 1.2MB
Sample260919-mrrbcazanc
SHA256 9f7dfdc9bab6a23818c8312fa6750080c0c1cc14174a30b85e2187e7f4d0a2a0
MD5 c18d4a6d35d95bdbf19d97829e6a9552
SHA1 bd13a9d5880b23763166a671843a9a8f0de32362
SHA512 b170064a7a4d236f8d89ad060c8afa591530a7e346c8e2677f8dae52444bbf674922edce7b14a13693c8485b597fb31788c52a41d5673cae06b23378736d8898
SSDEEP 24576:KiVOA1+LlJhqtE3mocM3tBZPzwFa7/wOifnz20:K7zCWmf4ZPzwFI/wOifnzH
TLSH
T1CB458D64AA050DFCEAF17638DBDE532593A13D95033644CF23D03F8A3A37992AE7A151
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_c18d4a6d35d95bdbf19d97829e6a9552_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-19_c18d4a6d35d95bdbf19d97829e6a9552_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.2MB

2026-09-19_c18d4a6d35d95bdbf19d97829e6a9552_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 84a549ce870e1f425823d22d601183b2
SHA256 9f7dfdc9bab6a23818c8312fa6750080c0c1cc14174a30b85e2187e7f4d0a2a0
MD5 c18d4a6d35d95bdbf19d97829e6a9552
SHA1 bd13a9d5880b23763166a671843a9a8f0de32362
SHA512 b170064a7a4d236f8d89ad060c8afa591530a7e346c8e2677f8dae52444bbf674922edce7b14a13693c8485b597fb31788c52a41d5673cae06b23378736d8898
SSDEEP 24576:KiVOA1+LlJhqtE3mocM3tBZPzwFa7/wOifnz20:K7zCWmf4ZPzwFI/wOifnzH
TLSH
T1CB458D64AA050DFCEAF17638DBDE532593A13D95033644CF23D03F8A3A37992AE7A151
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

96112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_win64\build\src\steam_monitor\win64\Release\steam_monitor.pdb

kernel32

GetProcAddress GetModuleHandleA OutputDebugStringA IsDebuggerPresent GetCurrentProcess TerminateProcess GetLastError EnterCriticalSection LeaveCriticalSection GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime SetUnhandledExceptionFilter FreeLibrary GetModuleFileNameW LoadLibraryExA LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte DeleteCriticalSection CloseHandle RaiseException SetLastError InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SetEvent ResetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcessId GetCurrentThreadId OpenThread GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree OpenProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW VirtualProtect GetModuleFileNameA LocalAlloc LocalFree GlobalAlloc GlobalUnlock GlobalLock DebugBreak GetProcessHeaps SetEnvironmentVariableW CreateFileW DeleteFileW CreateProcessW MoveFileExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx HeapSize HeapValidate GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent FlushFileBuffers GetConsoleOutputCP GetConsoleMode RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetFileType GetFileSizeEx SetFilePointerEx HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW ReadFile ReadConsoleW WriteConsoleW SetEndOfFile RtlUnwind

psapi

GetProcessMemoryInfo

user32

SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetDlgItemInt GetWindowRect MessageBoxA GetDesktopWindow EnumWindows GetWindowThreadProcessId GetDlgItemInt GetDlgItem EndDialog DialogBoxParamA IsWindowVisible SetWindowPos GetWindowTextLengthA wsprintfA

shell32

CommandLineToArgvW

Name

.text

Size

249KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_c18d4a6d35d95bdbf19d97829e6a9552_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

psapi

user32

shell32

generic