2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 1.4MB
Sample260924-e2kbsayeqf
SHA256 37ed08d8606f2c98c084e981601edf1ba3b63a6a6d8bb63b52bd288f9076ce94
MD5 100065d639ed9ce9a0196653f078ae5b
SHA1 bf9a260409de4e05d75ca4dc034b7fbb60e39d23
SHA512 25ed5b7ad28375f69305a2283ea9f1b77f643536b85231083491155e4a4303869d4cf3bc58eb4950a7a26aa1b099c4c218618dfcd10062ec039ebeb0b3b2ccec
SSDEEP 24576:ZN0DL//8jVxSjyffkJ7G75WmLr/HdmAaQh7mb57GBiOl6a8JTth/RWZvR6wQQ92b:ZefcmKcJiLr/9mA4b5+Pl6bJTIZ5jdgb
TLSH
T19F65D065A3E100F8D87B9139CAC65663FAF1B41217346EDF0AA48B223F276E5177E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.4MB

2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 0016f31674829e9b3acd87c749701935
SHA256 37ed08d8606f2c98c084e981601edf1ba3b63a6a6d8bb63b52bd288f9076ce94
MD5 100065d639ed9ce9a0196653f078ae5b
SHA1 bf9a260409de4e05d75ca4dc034b7fbb60e39d23
SHA512 25ed5b7ad28375f69305a2283ea9f1b77f643536b85231083491155e4a4303869d4cf3bc58eb4950a7a26aa1b099c4c218618dfcd10062ec039ebeb0b3b2ccec
SSDEEP 24576:ZN0DL//8jVxSjyffkJ7G75WmLr/HdmAaQh7mb57GBiOl6a8JTth/RWZvR6wQQ92b:ZefcmKcJiLr/9mA4b5+Pl6bJTIZ5jdgb
TLSH
T19F65D065A3E100F8D87B9139CAC65663FAF1B41217346EDF0AA48B223F276E5177E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

393952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\a\_work\1\s\OSS_Microsoft_OpenSSH_Dev\bin\x64\Release\ssh-keygen.pdb

libcrypto

EC_POINT_point2oct DSA_SIG_set0 DSA_free DSA_do_sign DSA_get0_key BN_bn2bin DSA_do_verify DSA_SIG_get0 DSA_new DSA_SIG_new DSA_get0_pqg DSA_generate_key DSA_generate_parameters_ex DSA_SIG_free ECDSA_do_sign EC_POINT_cmp EC_KEY_set_private_key EC_KEY_generate_key ECDSA_SIG_get0 EC_POINT_oct2point arc4random_uniform ECDSA_do_verify EC_KEY_new_by_curve_name EVP_sha384 EVP_MD_CTX_copy_ex EVP_MD_CTX_new EVP_md5 EVP_sha256 EVP_DigestUpdate EVP_Digest EVP_MD_CTX_free EVP_DigestInit_ex EVP_MD_CTX_md EVP_sha1 EVP_MD_block_size EVP_sha512 EVP_DigestFinal_ex EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_aes_256_cbc EVP_CipherInit EVP_aes_128_ctr EVP_aes_256_ctr EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_key_length EVP_aes_192_ctr EVP_Cipher EVP_aes_256_gcm EVP_aes_128_gcm EVP_CIPHER_CTX_free BN_dup RSA_generate_key_ex BN_set_flags RSA_public_decrypt RSA_set0_crt_params RSA_sign BN_div RSA_get0_factors RSA_get0_crt_params BN_CTX_new BN_CTX_free BN_lshift BN_is_prime_ex BN_copy PEM_write_RSAPrivateKey EC_KEY_set_asn1_flag EC_KEY_set_public_key BN_rand BN_rshift BN_set_bit BN_add BN_bn2hex BN_add_word BN_mod_word EC_KEY_METHOD_set_sign RSAPublicKey_dup X509_get_pubkey EC_KEY_set_method RSA_meth_set_priv_enc o2i_ECPublicKey d2i_ECPKParameters EC_KEY_METHOD_get_sign RSA_meth_set1_name d2i_ASN1_OCTET_STRING RSA_new RSA_free d2i_X509 d2i_X509_NAME BN_free ECDSA_size EC_KEY_get_ex_data EC_KEY_set_ex_data X509_NAME_free RSA_set_method EVP_PKEY_get0_EC_KEY EC_KEY_free EVP_PKEY_get0_RSA RSA_meth_dup ECDSA_SIG_free RSA_set_ex_data ERR_error_string EC_KEY_new RSA_size RSA_get_ex_data RSA_get_default_method RSA_get_ex_new_index RSA_meth_set_priv_dec ECDSA_SIG_set0 X509_free X509_NAME_oneline CRYPTO_get_ex_new_index ASN1_OCTET_STRING_free EC_KEY_METHOD_new EC_KEY_dup EC_KEY_OpenSSL ECDSA_SIG_new RAND_status OpenSSL_version_num gettimeofday timegm EVP_PKEY_set1_RSA RSA_blinding_on EC_GROUP_get_order BIO_new BIO_ctrl ERR_peek_error BN_value_one PEM_write_bio_DSAPrivateKey EVP_PKEY_new EC_METHOD_get_field_type EC_POINT_mul EVP_PKEY_set1_DSA ERR_get_error EC_POINT_get_affine_coordinates_GFp BN_print_fp ERR_peek_last_error arc4random EC_KEY_set_group EC_POINT_is_at_infinity arc4random_buf BIO_s_mem RSA_get0_key PEM_read_bio_PrivateKey EC_POINT_free EVP_aes_128_cbc EC_KEY_get0_public_key EC_GROUP_free EC_POINT_new BIO_write BIO_free EC_GROUP_cmp PEM_write_bio_ECPrivateKey EC_GROUP_set_asn1_flag EC_GROUP_get_curve_name EC_KEY_get0_private_key PEM_write_bio_RSAPrivateKey PEM_write_bio_PrivateKey EC_KEY_get0_group BN_cmp BN_sub EC_GROUP_new_by_curve_name EC_GROUP_method_of BN_num_bits EVP_PKEY_set1_EC_KEY BN_clear_free BN_hex2bn EVP_PKEY_get1_EC_KEY PEM_read_PUBKEY DSA_set0_key PEM_write_RSA_PUBKEY BN_set_word PEM_write_RSAPublicKey PEM_read_RSAPublicKey EVP_PKEY_free EVP_PKEY_get1_RSA PEM_write_DSA_PUBKEY RSA_set0_factors EVP_PKEY_get1_DSA BN_new PEM_write_DSAPrivateKey DSA_set0_pqg PEM_write_EC_PUBKEY RSA_set0_key explicit_bzero EVP_PKEY_base_id PEM_write_ECPrivateKey BN_bin2bn

crypt32

CryptStringToBinaryA CryptBinaryToStringA

ws2_32

WSADuplicateSocketW WSASocketW WSACleanup FreeAddrInfoW bind WSAIoctl closesocket WSASend WSAStartup getsockname socket gethostname GetAddrInfoW WSARecv WSAGetOverlappedResult setsockopt WSAGetLastError htonl

kernel32

GetFileSizeEx FreeLibraryAndExitThread ExitThread CreateThread FindNextFileW FindFirstFileExW FindClose FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetCommandLineW GetCommandLineA GetCurrentDirectoryW SetEnvironmentVariableW DeleteFileW GetFullPathNameW SetFileAttributesW RemoveDirectoryW SetStdHandle GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetConsoleOutputCP SetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetTimeZoneInformation GetStringTypeW GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCPInfo RtlUnwind GetEnvironmentStringsW HeapAlloc GetProcessHeap HeapSize GetLocalTime SetConsoleOutputCP CreateWaitableTimerA CancelIoEx CancelSynchronousIo WriteFile ReadFile WaitForSingleObjectEx WaitForMultipleObjectsEx LoadLibraryExW GetFinalPathNameByHandleW QueueUserAPC SetConsoleCtrlHandler GetDriveTypeW GetDiskFreeSpaceExW GetLogicalDriveStringsW ReadFileEx GetFileAttributesExW GetFileInformationByHandle CreateHardLinkW WriteFileEx DeviceIoControl CreateNamedPipeA CancelIo GetExitCodeProcess ReadConsoleOutputA SetConsoleCursorPosition GetConsoleWindow Beep WriteConsoleW FillConsoleOutputAttribute WriteConsoleOutputA CreateFileA ReadConsoleInputW SetConsoleCursorInfo GetConsoleMode SetConsoleWindowInfo GetConsoleCursorInfo ScrollConsoleScreenBufferA SetConsoleScreenBufferSize SetConsoleTextAttribute FillConsoleOutputCharacterA MultiByteToWideChar FlushFileBuffers OpenThread CreateProcessW GetCurrentProcessId SetFilePointerEx GetTickCount64 DuplicateHandle GetCurrentThreadId SetEndOfFile TerminateProcess SetHandleInformation GetWindowsDirectoryW GetSystemDirectoryW ExpandEnvironmentStringsW CreateEventA VerifyVersionInfoW SleepEx VerSetConditionMask ResetEvent SetEvent GetFileType WideCharToMultiByte HeapFree FreeEnvironmentStringsW FreeLibrary GetComputerNameW MoveFileExW LocalFree GetProcAddress LoadLibraryW CloseHandle GetLastError FormatMessageW CreateFileW WaitForSingleObject GetStdHandle GetCurrentProcess GetConsoleScreenBufferInfo CreateDirectoryW GetModuleFileNameW

user32

ShowWindow GetWindowPlacement

advapi32

IsValidSid EventWrite EventRegister GetTokenInformation LookupAccountNameW IsValidAcl GetLengthSid ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken IsValidSecurityDescriptor IsWellKnownSid GetNamedSecurityInfoW CopySid CreateWellKnownSid GetAce GetSidIdentifierAuthority RegQueryValueExW LookupAccountSidW ConvertSidToStringSidW RegOpenKeyExW RegCloseKey CreateProcessAsUserW EqualSid ConvertSidToStringSidA

Name

.text

Size

562KB

Virtual Size

561KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_100065d639ed9ce9a0196653f078ae5b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

libcrypto

crypt32

ws2_32

kernel32

user32

advapi32

generic