2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 4.2MB
Sample260926-tkl7daxbkd
SHA256 38918e827b5f5ae80a3c856b9fd6e2d37de04dfc16d3a75b58ff021b53fb8b2d
MD5 b78c1281c06e3912601d6096f967412d
SHA1 efd09629ca3e049d8c96678a99f138965cfada89
SHA512 3b7402bc24233ebfe0bfb67852ac5cce372b8a7ca063fca0578679585e6aee52468d2d393cd95355b486cd53d3a5e9f000072c9535866d1ec7addc1682d1f2a6
SSDEEP 49152:5Gtlq0/VwASOTBIU6i0aGCHceZo4pMPKJi1oYaitV2TXa2nU3O97d6UPBX/v9mSu:e2+V+4i1oYKKiAOxPAa9IblmiIS9Z
TLSH
T182268D56A65901FCD5B7D138C6CA5623E7B17C1603B18BCB02E0BA661F33AE16E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.2MB

2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 955f323c9a0933b01206409d301f16dd
SHA256 38918e827b5f5ae80a3c856b9fd6e2d37de04dfc16d3a75b58ff021b53fb8b2d
MD5 b78c1281c06e3912601d6096f967412d
SHA1 efd09629ca3e049d8c96678a99f138965cfada89
SHA512 3b7402bc24233ebfe0bfb67852ac5cce372b8a7ca063fca0578679585e6aee52468d2d393cd95355b486cd53d3a5e9f000072c9535866d1ec7addc1682d1f2a6
SSDEEP 49152:5Gtlq0/VwASOTBIU6i0aGCHceZo4pMPKJi1oYaitV2TXa2nU3O97d6UPBX/v9mSu:e2+V+4i1oYKKiAOxPAa9IblmiIS9Z
TLSH
T182268D56A65901FCD5B7D138C6CA5623E7B17C1603B18BCB02E0BA661F33AE16E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2379100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_win64\build\src\steamUI\gamestream\secure_desktop_capture\win64\Release\secure_desktop_capture.pdb

kernel32

GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock LocalAlloc LocalFree MultiByteToWideChar SetLastError OutputDebugStringA WriteConsoleW FreeEnvironmentStringsW GetModuleHandleA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetFilePointerEx SetStdHandle LCMapStringW CompareStringW HeapValidate HeapSize SetConsoleCtrlHandler GetModuleHandleExW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe IsProcessorFeaturePresent UnhandledExceptionFilter RtlCaptureContext GetModuleFileNameW FreeLibrary GetCurrentProcessId GetEnvironmentStringsW Sleep WriteFile GetFullPathNameW FindFirstFileW FindClose CreateFileW Process32Next Process32First CreateToolhelp32Snapshot CreateFileMappingA UnmapViewOfFile MapViewOfFile OpenProcess GetCurrentProcess CreateEventA WaitForSingleObject ResetEvent SetEvent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader InitializeSListHead GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLastError CloseHandle LeaveCriticalSection ExitProcess EnterCriticalSection SetEndOfFile ReadFile GetFileSizeEx GetFileInformationByHandle GetDriveTypeW GetCurrentDirectoryW FindNextFileW WideCharToMultiByte RtlVirtualUnwind InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetEnvironmentVariableW GetFileType GetModuleHandleW DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTime SystemTimeToFileTime IsDebuggerPresent TerminateProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW GlobalMemoryStatusEx VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameA GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation QueryPerformanceFrequency DuplicateHandle RaiseException TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread GetExitCodeThread SetUnhandledExceptionFilter LoadLibraryExA LoadLibraryExW LoadLibraryW DebugBreak GetProcessHeaps SetEnvironmentVariableW FindFirstFileExW FlushFileBuffers RtlUnwind

user32

SetDlgItemInt GetDlgItem EndDialog SetDlgItemTextA CloseClipboard SetClipboardData EmptyClipboard GetDesktopWindow CloseDesktop GetDlgItemInt OpenClipboard OpenDesktopA GetWindowTextLengthA DialogBoxParamA GetWindowThreadProcessId EnumWindows GetShellWindow GetWindowRect IsWindowVisible ReleaseDC GetDC GetCursorInfo LoadCursorA GetCursorPos MessageBoxA GetSystemMetrics SendInput GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfA SetWindowPos

gdi32

GdiFlush SetBrushOrgEx CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC BitBlt

advapi32

RegSetValueExA RegisterEventSourceW DeregisterEventSource OpenProcessToken AddAccessAllowedAce RegDeleteTreeA ReportEventW RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid CreateWellKnownSid CopySid

shell32

CommandLineToArgvW

psapi

GetProcessMemoryInfo

bcrypt

BCryptGenRandom

ws2_32

WSASetLastError recv closesocket send WSACleanup WSAGetLastError

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

766KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_b78c1281c06e3912601d6096f967412d_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

psapi

bcrypt

ws2_32

generic