2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 12.5MB
Sample260925-xefzystgnc
SHA256 d81af51ec8246875f0c205926fea880cc634b7cf44ab8fba1c559294f0e934c3
MD5 dc2803cce7f2739445ebf96b84e2f9be
SHA1 14a4c9b74be97e302e23d3c1da1bc16f442f8e4a
SHA512 6858f1e58415f5fbf5c073b8674089a3ee2913ad5303f6851cc132a50e44d0c4d573400b8af56f09a41a6452d8f03eb32e1dc72328f655cfc935e071b290dacb
SSDEEP 196608:4JjojYIYNj3XJy2KfMQzVRzqz5+yWKY4YVcYxP:4J8jYIYNj3XJy2KfMQuzLW+YVzP
TLSH
T1F6D63A157B5B95A8C0ABC07482878A675D7030CB0B35AAFF5584963D2F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 12.5MB

2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6b84c9d427c5499f9d9b775470eeb7ab
SHA256 d81af51ec8246875f0c205926fea880cc634b7cf44ab8fba1c559294f0e934c3
MD5 dc2803cce7f2739445ebf96b84e2f9be
SHA1 14a4c9b74be97e302e23d3c1da1bc16f442f8e4a
SHA512 6858f1e58415f5fbf5c073b8674089a3ee2913ad5303f6851cc132a50e44d0c4d573400b8af56f09a41a6452d8f03eb32e1dc72328f655cfc935e071b290dacb
SSDEEP 196608:4JjojYIYNj3XJy2KfMQzVRzqz5+yWKY4YVcYxP:4J8jYIYNj3XJy2KfMQuzLW+YVzP
TLSH
T1F6D63A157B5B95A8C0ABC07482878A675D7030CB0B35AAFF5584963D2F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6373328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

esea_ac.pdb

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RegGetValueW RegQueryValueExW RegCloseKey EventSetInformation EventRegister EventUnregister EventWriteTransfer

ntdll

RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile NtWriteFile

kernel32

IsProcessorFeaturePresent LoadLibraryW TlsAlloc TlsGetValue IsDebuggerPresent TlsSetValue TlsFree GetSystemTimeAsFileTime SleepConditionVariableSRW GetFullPathNameW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead UnhandledExceptionFilter FindNextFileW QueryPerformanceFrequency GetTempPathW WaitForMultipleObjects SetUnhandledExceptionFilter FlsSetValue GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeviceIoControl GetFinalPathNameByHandleW CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose lstrlenW LoadLibraryA EncodePointer FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetModuleHandleW RaiseException GetExitCodeProcess GetEnvironmentStringsW TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetUserDefaultUILanguage LCIDToLocaleName GetFileInformationByHandleEx SetFileTime CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WriteFileEx SleepEx ReadFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter HeapReAlloc GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW RtlUnwindEx FreeLibrary DuplicateHandle GetCurrentThreadId GetCurrentProcess GetStdHandle SetFileInformationByHandle SetLastError WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle GetConsoleMode GetFileInformationByHandle ReleaseMutex DeleteCriticalSection CreateFileW RtlPcToFileHeader GetOverlappedResult ReadFile InitializeCriticalSectionAndSpinCount LoadLibraryExA HeapAlloc GetQueuedCompletionStatusEx PostQueuedCompletionStatus FormatMessageW CreateDirectoryW CreateIoCompletionPort IsThreadAFiber CreateMutexW

user32

PostThreadMessageW VkKeyScanW DestroyMenu GetMessageA PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW DrawIconEx CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar MapVirtualKeyW CreatePopupMenu CreateMenu DrawTextW GetWindowDC OffsetRect GetMenuBarInfo GetMenuItemInfoW SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx FlashWindowEx RegisterClassExW CreateIcon GetAsyncKeyState GetKeyboardState RedrawWindow SetForegroundWindow DispatchMessageA EnumChildWindows SetWindowTextW GetWindowTextW GetWindowTextLengthW PostMessageW EnumDisplayMonitors MonitorFromPoint GetMenu DefWindowProcW MapVirtualKeyExW ToUnicodeEx GetKeyState GetRawInputData DestroyWindow SystemParametersInfoA SetPropW GetKeyboardLayout SetWindowDisplayAffinity ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu DestroyIcon ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SendInput RegisterRawInputDevices TranslateAcceleratorW FindWindowW RegisterWindowMessageA GetWindow SetParent SendMessageW MapWindowPoints SetFocus ShowWindow AdjustWindowRect DispatchMessageW ChangeDisplaySettingsExW PeekMessageW EnableWindow IsWindowEnabled ReleaseDC GetDC IsProcessDPIAware SetCursor GetWindowRect GetParent FindWindowExW SetWindowRgn TranslateMessage IsWindowVisible SetWindowLongPtrW GetWindowLongPtrW SetWindowPlacement GetWindowPlacement GetMessageW SetWindowPos InvalidateRgn CreateWindowExW GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos LoadCursorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient GetUpdateRect ValidateRect RegisterClassW RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx IsIconic

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

shlwapi

SHCreateMemStream

ole32

CoUninitialize CoTaskMemFree CoTaskMemAlloc CoInitialize RevokeDragDrop RegisterDragDrop CoInitializeEx CoCreateFreeThreadedMarshaler OleInitialize CoCreateInstance

gdi32

CreateSolidBrush SelectObject CreateDIBSection SetBkMode SetTextColor GetDeviceCaps BitBlt CreateCompatibleDC CreateRectRgn DeleteObject DeleteDC CombineRgn

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

DragQueryFileW SHAppBarMessage ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconGetRect SHOpenFolderAndSelectItems DragFinish ILCreateFromPathW ILFree ShellExecuteExW Shell_NotifyIconW

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-crt-math-l1-1-0

pow round __setusermatherr roundf trunc floor

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s strcmp wcsncmp wcslen _wcsicmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _crt_atexit _c_exit _initterm _initterm_e _register_thread_local_exe_atexit_callback exit _exit _get_initial_narrow_environment _cexit _initialize_narrow_environment terminate _register_onexit_function _configure_narrow_argv _initialize_onexit_table _seh_filter_exe __p___argc _set_app_type abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode _callnewh malloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_dc2803cce7f2739445ebf96b84e2f9be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

bcryptprimitives

advapi32

ntdll

kernel32

user32

comctl32

shlwapi

ole32

gdi32

dwmapi

api-ms-win-core-synch-l1-2-0

shell32

oleaut32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic