2026-09-29_9258c77b82fa83f67155012a7bcd9b22_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_9258c77b82fa83f67155012a7bcd9b22_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 9.9MB
Sample260929-y3st4aee84
SHA256 75f809949dbebcb8178757c9f65fcce3b243a698c98eee6f4321c498e3fee24d
MD5 9258c77b82fa83f67155012a7bcd9b22
SHA1 f9814c7e01a34a2ead2cb93d1420ab57e1ac5a3e
SHA512 46b8d31ed42c75643f08d0eb9b9264bc76cea1cbcd054a9ac632dd74635e5735c9852579964ce333adba9c02f774e07dca3fd559ec8f55c80769b295452b238d
SSDEEP 98304:jdgC2JwlNKQb046R9qf5XQUlBQ/M4QCJZ6sbtaVHroUktfd:jW6fKQb15XQUX8X8xsLBd
TLSH
T1D0A6072F27A919ADC4B6B3BED5060F80F13F7055075296CB079012F56DAEAD88FBB520
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_9258c77b82fa83f67155012a7bcd9b22_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-29_9258c77b82fa83f67155012a7bcd9b22_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 9.9MB

2026-09-29_9258c77b82fa83f67155012a7bcd9b22_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 465e08dc9f9297ad6ca347fe74495ba6
SHA256 75f809949dbebcb8178757c9f65fcce3b243a698c98eee6f4321c498e3fee24d
MD5 9258c77b82fa83f67155012a7bcd9b22
SHA1 f9814c7e01a34a2ead2cb93d1420ab57e1ac5a3e
SHA512 46b8d31ed42c75643f08d0eb9b9264bc76cea1cbcd054a9ac632dd74635e5735c9852579964ce333adba9c02f774e07dca3fd559ec8f55c80769b295452b238d
SSDEEP 98304:jdgC2JwlNKQb046R9qf5XQUlBQ/M4QCJZ6sbtaVHroUktfd:jW6fKQb15XQUX8X8xsLBd
TLSH
T1D0A6072F27A919ADC4B6B3BED5060F80F13F7055075296CB079012F56DAEAD88FBB520
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4270784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\target\Windows\x64\symbols\Release\AdskUninstallHelper.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

msi

ord246 ord173 ord217 ord8 ord169 ord118 ord92 ord150 ord78 ord160 ord70 ord32 ord205 ord159 ord44 ord244 ord238

shlwapi

PathRemoveFileSpecW PathUnquoteSpacesW PathIsUNCW PathFileExistsW

authz

AuthzInitializeContextFromSid AuthzFreeResourceManager AuthzInitializeResourceManager AuthzAccessCheck AuthzFreeContext

mpr

WNetGetConnectionW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory WTSQuerySessionInformationW

secur32

LsaGetLogonSessionData LsaEnumerateLogonSessions LsaFreeReturnBuffer

kernel32

TlsGetValue DecodePointer GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW LocalFree FormatMessageA FormatMessageW WideCharToMultiByte MoveFileExW FindResourceExW LoadResource LockResource SizeofResource FindResourceW LocalAlloc GetSystemInfo GetModuleHandleW CreateFileW GetFileAttributesExW GetFileSize ReadFile CloseHandle GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW FreeLibrary GetProcAddress LoadLibraryW GetEnvironmentStringsW FreeEnvironmentStringsW WriteFile AreFileApisANSI SetHandleInformation CreatePipe WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessW GetSystemDirectoryW LoadLibraryExW MultiByteToWideChar ExpandEnvironmentStringsW GetFileAttributesW GetFullPathNameW GetCurrentProcess GetCurrentProcessId ProcessIdToSessionId OpenProcess GetWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile AddDllDirectory GlobalAlloc TlsSetValue lstrcpyW QueryFullProcessImageNameW SetDllDirectoryW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32EnumProcessModules K32GetModuleFileNameExW GetTempPathW GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FlushFileBuffers GetFileInformationByHandle GetFinalPathNameByHandleW GetFileTime RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime DeviceIoControl CreateDirectoryExW CopyFileExW CreateEventA SetEvent WaitForSingleObjectEx GetLocaleInfoA EnumSystemLocalesA IsValidCodePage FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW IsDBCSLeadByteEx WakeConditionVariable TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RtlPcToFileHeader InterlockedFlushSList GetCPInfo CompareStringEx LCMapStringEx EncodePointer LeaveCriticalSection InterlockedPushEntrySList IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead EnterCriticalSection QueryPerformanceFrequency QueryPerformanceCounter TlsFree CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW WakeAllConditionVariable InitOnceExecuteOnce GetCurrentThread FlsAlloc FlsGetValue FlsSetValue FlsFree IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx ReadConsoleW GetTimeZoneInformation SetConsoleCtrlHandler GetACP GetOEMCP SetEnvironmentVariableW SetStdHandle WriteConsoleW CreateEventExW CreateSemaphoreExW RaiseException OutputDebugStringW IsDebuggerPresent CloseThreadpoolWait SetThreadpoolWait FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns GlobalFree RtlUnwind CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer GetLocaleInfoEx GetStringTypeW FindClose FindFirstFileW FindFirstFileExW FindNextFileW SetFileInformationByHandle CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 CreateThreadpoolTimer

user32

UnregisterClassW GetWindowThreadProcessId EnumWindows GetShellWindow ExitWindowsEx

shell32

SHGetFileInfoW SHGetKnownFolderPath ShellExecuteExW ord51 CommandLineToArgvW

ole32

CoInitialize CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree CoCreateInstance CoInitializeEx

oleaut32

GetErrorInfo CreateErrorInfo SetErrorInfo VariantChangeType VariantInit SysAllocString SysFreeString VariantClear

advapi32

RegDeleteTreeW LookupAccountNameW RegCloseKey RegOpenKeyExW RegGetValueW SetEntriesInAclW ConvertSidToStringSidW CreateProcessWithTokenW LookupPrivilegeValueW LookupAccountSidW RevertToSelf ImpersonateLoggedOnUser GetTokenInformation FreeSid EqualSid DuplicateTokenEx CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW RegSetValueExW CreateWellKnownSid RegRenameKey RegQueryValueExW RegQueryInfoKeyW RegEnumValueW GetNamedSecurityInfoW SetNamedSecurityInfoW RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW

ws2_32

WSAStartup WSACleanup

wintrust

WinVerifyTrust

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CryptQueryObject CryptMsgClose

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z ??0?$singleton@V?$extended_type_info_typeid@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@VBundleData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@VPackageData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??1?$codecvt_null@_W@archive@boost@@UEAA@XZ ??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VBundleData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@VBundleData@Serialization@Autodesk@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPackageData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@VPackageData@Serialization@Autodesk@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@VBundleData@Serialization@Autodesk@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@VBundleData@Serialization@Autodesk@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@VPackageData@Serialization@Autodesk@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@VPackageData@Serialization@Autodesk@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QEAA_NXZ ?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@VBundleData@Serialization@Autodesk@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@VPackageData@Serialization@Autodesk@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QEAAXXZ ?unlock@singleton_module@serialization@boost@@QEAAXXZ

Name

.text

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

458KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

436KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_9258c77b82fa83f67155012a7bcd9b22_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

version

msi

shlwapi

authz

mpr

userenv

wtsapi32

secur32

kernel32

user32

shell32

ole32

oleaut32

advapi32

ws2_32

wintrust

crypt32

bcrypt

generic