2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

General

Target
2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar
Size 5.2MB
Sample260928-qmapksvemf
SHA256 764ccbc08ba997ba9f1f913778aa1e9dc4ce9a7fc2e2b2da47254913a45f84cd
MD5 9e7ca2a7306a48eb3d39ea74f04dacfa
SHA1 7ab02115f33e185ab2ce187a1ac7c289388abc88
SHA512 e58fd4e7863df5495e22370e08debdb1c28533d1a51b06df2f7b092f5f5afbd47194842d7223b38b88f037f598c802cf4c10de415b5ffeefa91494903e743683
SSDEEP 98304:tVMDtIXLr06AdfEThF35PzuIcymc620c+aDBpRB:prmEdF3lcymDE5DBp7
TLSH
T19346D01693FE00E9D1BBD1BE8A038517EAB1781D0B3356DB05709A5B6F7BAD04E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

File Explorer

2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

.exe 5.2MB

2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

IMPHASH 26db5052cd8ede8ee590a842731769c5
SHA256 764ccbc08ba997ba9f1f913778aa1e9dc4ce9a7fc2e2b2da47254913a45f84cd
MD5 9e7ca2a7306a48eb3d39ea74f04dacfa
SHA1 7ab02115f33e185ab2ce187a1ac7c289388abc88
SHA512 e58fd4e7863df5495e22370e08debdb1c28533d1a51b06df2f7b092f5f5afbd47194842d7223b38b88f037f598c802cf4c10de415b5ffeefa91494903e743683
SSDEEP 98304:tVMDtIXLr06AdfEThF35PzuIcymc620c+aDBpRB:prmEdF3lcymDE5DBp7
TLSH
T19346D01693FE00E9D1BBD1BE8A038517EAB1781D0B3356DB05709A5B6F7BAD04E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA LockResource LoadResource SizeofResource FindResourceA WideCharToMultiByte MultiByteToWideChar WriteFile DeleteFileA CreateDirectoryA GetProcAddress LoadLibraryA lstrcatA GetSystemTime GetModuleHandleA GetModuleFileNameA GetTempPathA GetFileSize WaitForSingleObject ResumeThread SetThreadPriority CreateThread GetStringTypeA LCMapStringW LCMapStringA SetEndOfFile GetOEMCP GetACP GetCPInfo IsBadCodePtr IsBadReadPtr FlushFileBuffers SetStdHandle SetUnhandledExceptionFilter GetComputerNameA CloseHandle GetFileType GetStdHandle HeapAlloc RtlUnwind GetStartupInfoA GetCommandLineA GetVersion ExitProcess HeapFree RaiseException GetLastError HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr ReadFile TerminateProcess GetCurrentProcess SetFilePointer HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStringTypeW

user32

DefWindowProcA PostQuitMessage DestroyWindow CreateWindowExA ShowWindow GetMessageA TranslateMessage DispatchMessageA GetDesktopWindow RegisterClassExA

shell32

SHGetSpecialFolderPathA

advapi32

GetUserNameA

shlwapi

PathFileExistsA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_9e7ca2a7306a48eb3d39ea74f04dacfa_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

kernel32

user32

shell32

advapi32

shlwapi

generic