2026-09-22_3349e9b5bf2db61cdf3f0a58258b13ea_cobalt-strike_glassworm_icedid_moonclient_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_3349e9b5bf2db61cdf3f0a58258b13ea_cobalt-strike_glassworm_icedid_moonclient_njrat_satacom_stealc
Size 11.8MB
Sample260922-1alanasfph
SHA256 38b0df0dd73f1210b03969730f9154e3f603f800e54df900d720049f9fe39c7a
MD5 3349e9b5bf2db61cdf3f0a58258b13ea
SHA1 240e2c20eaf622deb1187bc10009e6f6c4d5795f
SHA512 c7f94973dad07ed40c3420290bf217b67050f7b98e191ba54fe645e7ab9aaf8f1808085da81093ce0e529ab1f1a0016339a643c54960907964a18c72ad85f755
SSDEEP 196608:MyTCrxUglHwYwoIGOe3VoSXK95BL3z2Ukk+fxrlmC5cfN:MslyHlwBIlxXKDt3CdfZlmK8
TLSH
T13DC602AA7294226DC027D0348467EA16F7B3341907A496DBB3E9EAD03F737E49536F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_3349e9b5bf2db61cdf3f0a58258b13ea_cobalt-strike_glassworm_icedid_moonclient_njrat_satacom_stealc

File Explorer

2026-09-22_3349e9b5bf2db61cdf3f0a58258b13ea_cobalt-strike_glassworm_icedid_moonclient_njrat_satacom_stealc

.exe 11.8MB

2026-09-22_3349e9b5bf2db61cdf3f0a58258b13ea_cobalt-strike_glassworm_icedid_moonclient_njrat_satacom_stealc

IMPHASH 0edb280df5753a1001dc02e3fb4d97c9
SHA256 38b0df0dd73f1210b03969730f9154e3f603f800e54df900d720049f9fe39c7a
MD5 3349e9b5bf2db61cdf3f0a58258b13ea
SHA1 240e2c20eaf622deb1187bc10009e6f6c4d5795f
SHA512 c7f94973dad07ed40c3420290bf217b67050f7b98e191ba54fe645e7ab9aaf8f1808085da81093ce0e529ab1f1a0016339a643c54960907964a18c72ad85f755
SSDEEP 196608:MyTCrxUglHwYwoIGOe3VoSXK95BL3z2Ukk+fxrlmC5cfN:MslyHlwBIlxXKDt3CdfZlmK8
TLSH
T13DC602AA7294226DC027D0348467EA16F7B3341907A496DBB3E9EAD03F737E49536F01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7066404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualFreeEx GetSystemTimeAsFileTime LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

SetClipboardData GetUserObjectInformationW GetProcessWindowStation GetUserObjectInformationW

advapi32

RegSetValueExW

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

xinput1_4

ord2

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

ws2_32

getsockopt

crypt32

CertOpenStore

wldap32

ord33

normaliz

IdnToAscii

rpcrt4

UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-stdio-l1-1-0

_lseeki64

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-time-l1-1-0

_gmtime64

shell32

ShellExecuteA

wtsapi32

WTSSendMessageW

Name

.text

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

161KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

98KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_3349e9b5bf2db61cdf3f0a58258b13ea_cobalt-strike_glassworm_icedid_moonclient_njrat_satacom_stealc

kernel32

user32

advapi32

msvcp140

imm32

d3dcompiler_47

xinput1_4

d3d11

dwmapi

ws2_32

crypt32

wldap32

normaliz

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

shell32

wtsapi32

generic