2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
Size 6.8MB
Sample260928-c3a4dsvsbx
SHA256 3500ef5f7b6da58e80544f08cbb5174c92e5c41c8d2960989eced97243096530
MD5 97d97e945c50767a14599e536ec3ca6c
SHA1 7809f0ae460cdb9fe22eac674acb30e0eb90983d
SHA512 7f8db078d788ea1ea4faec0688669c3a10185f2566382a84e46a28314e2436f6638e136c98671b3f84399f6a324afca9ce024913575b5dc80d8fb512e3e5266f
SSDEEP 98304:Lo+0x9FjO509xZqNcxfH64NWg/29z4V4wFRKIhm4XoFmsieu:shx9M509XqNcxfH64Ix9zMHDKI0lmr3
TLSH
T15A66BE66A6A450ECD577C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

File Explorer

2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

.exe 6.8MB

2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

IMPHASH 7df38e7ed5c3951c98bd977e3eb4cc23
SHA256 3500ef5f7b6da58e80544f08cbb5174c92e5c41c8d2960989eced97243096530
MD5 97d97e945c50767a14599e536ec3ca6c
SHA1 7809f0ae460cdb9fe22eac674acb30e0eb90983d
SHA512 7f8db078d788ea1ea4faec0688669c3a10185f2566382a84e46a28314e2436f6638e136c98671b3f84399f6a324afca9ce024913575b5dc80d8fb512e3e5266f
SSDEEP 98304:Lo+0x9FjO509xZqNcxfH64NWg/29z4V4wFRKIhm4XoFmsieu:shx9M509XqNcxfH64Ix9zMHDKI0lmr3
TLSH
T15A66BE66A6A450ECD577C178CA468617E7F2BC0513719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2006376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\steamexe\win64\Release\steamexe.pdb

kernel32

GetExitCodeProcess GetCurrentProcess WaitForSingleObject SystemTimeToFileTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe WriteFile IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ExitProcess RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GlobalAlloc SizeofResource LockResource OpenProcess LoadResource GetModuleFileNameW GetProductInfo GetVersionExA SetStdHandle GetFullPathNameW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress GetCurrentThreadId Sleep CreateSymbolicLinkW DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW InitializeSListHead SleepConditionVariableSRW GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SetProcessAffinityMask GetProcessHeaps DebugBreak SetUnhandledExceptionFilter GetProcessAffinityMask GetSystemInfo GetLastError ProcessIdToSessionId CreateProcessW OutputDebugStringW SetCurrentDirectoryW SetEnvironmentVariableW SetThreadAffinityMask TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId OpenEventA SetEvent SetErrorMode CloseHandle ResumeThread SuspendThread GetExitCodeThread TerminateThread SetThreadPriority OpenThread RemoveDirectoryA GetFileAttributesA MultiByteToWideChar LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetFileType GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetDateFormatW GetTimeFormatW GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent CreateEventA WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent TerminateProcess GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree RtlCaptureStackBackTrace GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread

user32

GetDC CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW DestroyWindow GetWindowThreadProcessId EnumWindows GetUserObjectInformationW IsWindowVisible ReleaseDC GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer SetTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow MsgWaitForMultipleObjects SetWindowPos MoveWindow GetProcessWindowStation AllowSetForegroundWindow MessageBoxA ShowWindow

gdi32

RemoveFontMemResourceEx TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegSetValueExW RegQueryValueExW ReportEventW

shell32

ord680 SHGetFileInfoW CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

comctl32

InitCommonControlsEx

psapi

GetModuleInformation GetProcessMemoryInfo GetModuleFileNameExW

version

VerQueryValueW

crypt32

CertOpenStore CertGetCertificateChain CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

send htonl htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError recv WSARecvFrom WSASend WSASendTo WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup connect bind WSAIoctl setsockopt getsockname WSARecv ioctlsocket

wsock32

ord1142

bcrypt

BCryptGenRandom

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_97d97e945c50767a14599e536ec3ca6c_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic