2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 12.5MB
Sample260924-dl8trscf47
SHA256 b7fedad13497b4a5c65c802581d5c311bfe1f9235925e5c1d4228671af0e498f
MD5 b3f7ff78266465e12f903fbf569c2667
SHA1 c72548f31e4aaa66a4221c63d0fba754af72708a
SHA512 c91ef4b696dff0ca7a94809ab7286e8a609e195296b811fb75058ca07c837a2b678f089c003e43b09d926e5fe7979e06bdd440a91b2c1cb23f4457de3e24b355
SSDEEP 196608:pJjojYIYNj3XJy2KfMQHVRzq05OyagY4YVcKxP:pJ8jYIYNj3XJy2KfMQK0zaQYVpP
TLSH
T138D63A157B5B95A8C0ABC07482878A675D7030DB0B35AAFF5484963D2F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 12.5MB

2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6b84c9d427c5499f9d9b775470eeb7ab
SHA256 b7fedad13497b4a5c65c802581d5c311bfe1f9235925e5c1d4228671af0e498f
MD5 b3f7ff78266465e12f903fbf569c2667
SHA1 c72548f31e4aaa66a4221c63d0fba754af72708a
SHA512 c91ef4b696dff0ca7a94809ab7286e8a609e195296b811fb75058ca07c837a2b678f089c003e43b09d926e5fe7979e06bdd440a91b2c1cb23f4457de3e24b355
SSDEEP 196608:pJjojYIYNj3XJy2KfMQHVRzq05OyagY4YVcKxP:pJ8jYIYNj3XJy2KfMQK0zaQYVpP
TLSH
T138D63A157B5B95A8C0ABC07482878A675D7030DB0B35AAFF5484963D2F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6373328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

esea_ac.pdb

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RegGetValueW RegQueryValueExW RegCloseKey EventSetInformation EventRegister EventUnregister EventWriteTransfer

ntdll

RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile NtWriteFile

kernel32

IsProcessorFeaturePresent LoadLibraryW TlsAlloc TlsGetValue IsDebuggerPresent TlsSetValue TlsFree GetSystemTimeAsFileTime SleepConditionVariableSRW GetFullPathNameW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead UnhandledExceptionFilter FindNextFileW QueryPerformanceFrequency GetTempPathW WaitForMultipleObjects SetUnhandledExceptionFilter FlsSetValue GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeviceIoControl GetFinalPathNameByHandleW CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose lstrlenW LoadLibraryA EncodePointer FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetModuleHandleW RaiseException GetExitCodeProcess GetEnvironmentStringsW TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetUserDefaultUILanguage LCIDToLocaleName GetFileInformationByHandleEx SetFileTime CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WriteFileEx SleepEx ReadFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter HeapReAlloc GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW RtlUnwindEx FreeLibrary DuplicateHandle GetCurrentThreadId GetCurrentProcess GetStdHandle SetFileInformationByHandle SetLastError WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle GetConsoleMode GetFileInformationByHandle ReleaseMutex DeleteCriticalSection CreateFileW RtlPcToFileHeader GetOverlappedResult ReadFile InitializeCriticalSectionAndSpinCount LoadLibraryExA HeapAlloc GetQueuedCompletionStatusEx PostQueuedCompletionStatus FormatMessageW CreateDirectoryW CreateIoCompletionPort IsThreadAFiber CreateMutexW

user32

PostThreadMessageW VkKeyScanW DestroyMenu GetMessageA PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW DrawIconEx CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar MapVirtualKeyW CreatePopupMenu CreateMenu DrawTextW GetWindowDC OffsetRect GetMenuBarInfo GetMenuItemInfoW SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx FlashWindowEx RegisterClassExW CreateIcon GetAsyncKeyState GetKeyboardState RedrawWindow SetForegroundWindow DispatchMessageA EnumChildWindows SetWindowTextW GetWindowTextW GetWindowTextLengthW PostMessageW EnumDisplayMonitors MonitorFromPoint GetMenu DefWindowProcW MapVirtualKeyExW ToUnicodeEx GetKeyState GetRawInputData DestroyWindow SystemParametersInfoA SetPropW GetKeyboardLayout SetWindowDisplayAffinity ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu DestroyIcon ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SendInput RegisterRawInputDevices TranslateAcceleratorW FindWindowW RegisterWindowMessageA GetWindow SetParent SendMessageW MapWindowPoints SetFocus ShowWindow AdjustWindowRect DispatchMessageW ChangeDisplaySettingsExW PeekMessageW EnableWindow IsWindowEnabled ReleaseDC GetDC IsProcessDPIAware SetCursor GetWindowRect GetParent FindWindowExW SetWindowRgn TranslateMessage IsWindowVisible SetWindowLongPtrW GetWindowLongPtrW SetWindowPlacement GetWindowPlacement GetMessageW SetWindowPos InvalidateRgn CreateWindowExW GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos LoadCursorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient GetUpdateRect ValidateRect RegisterClassW RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx IsIconic

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

shlwapi

SHCreateMemStream

ole32

CoUninitialize CoTaskMemFree CoTaskMemAlloc CoInitialize RevokeDragDrop RegisterDragDrop CoInitializeEx CoCreateFreeThreadedMarshaler OleInitialize CoCreateInstance

gdi32

CreateSolidBrush SelectObject CreateDIBSection SetBkMode SetTextColor GetDeviceCaps BitBlt CreateCompatibleDC CreateRectRgn DeleteObject DeleteDC CombineRgn

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

DragQueryFileW SHAppBarMessage ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconGetRect SHOpenFolderAndSelectItems DragFinish ILCreateFromPathW ILFree ShellExecuteExW Shell_NotifyIconW

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-crt-math-l1-1-0

pow round __setusermatherr roundf trunc floor

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s strcmp wcsncmp wcslen _wcsicmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _crt_atexit _c_exit _initterm _initterm_e _register_thread_local_exe_atexit_callback exit _exit _get_initial_narrow_environment _cexit _initialize_narrow_environment terminate _register_onexit_function _configure_narrow_argv _initialize_onexit_table _seh_filter_exe __p___argc _set_app_type abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode _callnewh malloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_b3f7ff78266465e12f903fbf569c2667_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

bcryptprimitives

advapi32

ntdll

kernel32

user32

comctl32

shlwapi

ole32

gdi32

dwmapi

api-ms-win-core-synch-l1-2-0

shell32

oleaut32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic