2026-09-29_257967941bfb885ec9f3b0aead0f2dea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_257967941bfb885ec9f3b0aead0f2dea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 9.9MB
Sample260930-etaglswdph
SHA256 9a06b5b441c0713e922b552548fbeaf87671a21b69b69bfd714a51a1440a5004
MD5 257967941bfb885ec9f3b0aead0f2dea
SHA1 cc595ebb13747c65a98d1bbc2d4dd9aa65b9b511
SHA512 d5081fc43885a060406610f3e55f50e2e3879c1333e621a48f7296417570d64381fc4d8c63c4821b0af4b68d5eb16a70dddca6256a4958a4fd939abacaf2a295
SSDEEP 98304:SawywZYghgl9ldwkilC4AX7PBeUOdrCXQJnKdCRtfd:ZwyWFhgl9EC4A+daMRBd
TLSH
T162A6072F27A919ADC4B6B3BED5160F80E17F7045075287DF079002F56DAEAD88FBA520
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_257967941bfb885ec9f3b0aead0f2dea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-29_257967941bfb885ec9f3b0aead0f2dea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 9.9MB

2026-09-29_257967941bfb885ec9f3b0aead0f2dea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 465e08dc9f9297ad6ca347fe74495ba6
SHA256 9a06b5b441c0713e922b552548fbeaf87671a21b69b69bfd714a51a1440a5004
MD5 257967941bfb885ec9f3b0aead0f2dea
SHA1 cc595ebb13747c65a98d1bbc2d4dd9aa65b9b511
SHA512 d5081fc43885a060406610f3e55f50e2e3879c1333e621a48f7296417570d64381fc4d8c63c4821b0af4b68d5eb16a70dddca6256a4958a4fd939abacaf2a295
SSDEEP 98304:SawywZYghgl9ldwkilC4AX7PBeUOdrCXQJnKdCRtfd:ZwyWFhgl9EC4A+daMRBd
TLSH
T162A6072F27A919ADC4B6B3BED5160F80E17F7045075287DF079002F56DAEAD88FBA520
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4243104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\target\Windows\x64\symbols\Release\AdskUninstallHelper.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

msi

ord246 ord173 ord217 ord8 ord169 ord118 ord92 ord150 ord78 ord160 ord70 ord32 ord205 ord159 ord44 ord244 ord238

shlwapi

PathRemoveFileSpecW PathUnquoteSpacesW PathIsUNCW PathFileExistsW

authz

AuthzInitializeContextFromSid AuthzFreeResourceManager AuthzInitializeResourceManager AuthzAccessCheck AuthzFreeContext

mpr

WNetGetConnectionW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSQueryUserToken WTSFreeMemory WTSQuerySessionInformationW

secur32

LsaGetLogonSessionData LsaEnumerateLogonSessions LsaFreeReturnBuffer

kernel32

TlsGetValue DecodePointer GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW LocalFree FormatMessageA FormatMessageW WideCharToMultiByte MoveFileExW FindResourceExW LoadResource LockResource SizeofResource FindResourceW LocalAlloc GetSystemInfo GetModuleHandleW CreateFileW GetFileAttributesExW GetFileSize ReadFile CloseHandle GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW FreeLibrary GetProcAddress LoadLibraryW GetEnvironmentStringsW FreeEnvironmentStringsW WriteFile AreFileApisANSI SetHandleInformation CreatePipe WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessW GetSystemDirectoryW LoadLibraryExW MultiByteToWideChar ExpandEnvironmentStringsW GetFileAttributesW GetFullPathNameW GetCurrentProcess GetCurrentProcessId ProcessIdToSessionId OpenProcess GetWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile AddDllDirectory GlobalAlloc TlsSetValue lstrcpyW QueryFullProcessImageNameW SetDllDirectoryW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32EnumProcessModules K32GetModuleFileNameExW GetTempPathW GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FlushFileBuffers GetFileInformationByHandle GetFinalPathNameByHandleW GetFileTime RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime DeviceIoControl CreateDirectoryExW CopyFileExW CreateEventA SetEvent WaitForSingleObjectEx GetLocaleInfoA EnumSystemLocalesA IsValidCodePage FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW IsDBCSLeadByteEx WakeConditionVariable TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RtlPcToFileHeader InterlockedFlushSList GetCPInfo CompareStringEx LCMapStringEx EncodePointer LeaveCriticalSection InterlockedPushEntrySList IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead EnterCriticalSection QueryPerformanceFrequency QueryPerformanceCounter TlsFree CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW WakeAllConditionVariable InitOnceExecuteOnce GetCurrentThread FlsAlloc FlsGetValue FlsSetValue FlsFree IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx ReadConsoleW GetTimeZoneInformation SetConsoleCtrlHandler GetACP GetOEMCP SetEnvironmentVariableW SetStdHandle WriteConsoleW CreateEventExW CreateSemaphoreExW RaiseException OutputDebugStringW IsDebuggerPresent CloseThreadpoolWait SetThreadpoolWait FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns GlobalFree RtlUnwind CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer GetLocaleInfoEx GetStringTypeW FindClose FindFirstFileW FindFirstFileExW FindNextFileW SetFileInformationByHandle CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 CreateThreadpoolTimer

user32

UnregisterClassW GetWindowThreadProcessId EnumWindows GetShellWindow ExitWindowsEx

shell32

SHGetFileInfoW SHGetKnownFolderPath ShellExecuteExW ord51 CommandLineToArgvW

ole32

CoInitialize CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoTaskMemFree CoCreateInstance CoInitializeEx

oleaut32

GetErrorInfo CreateErrorInfo SetErrorInfo VariantChangeType VariantInit SysAllocString SysFreeString VariantClear

advapi32

RegDeleteTreeW LookupAccountNameW RegCloseKey RegOpenKeyExW RegGetValueW SetEntriesInAclW ConvertSidToStringSidW CreateProcessWithTokenW LookupPrivilegeValueW LookupAccountSidW RevertToSelf ImpersonateLoggedOnUser GetTokenInformation FreeSid EqualSid DuplicateTokenEx CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW RegSetValueExW CreateWellKnownSid RegRenameKey RegQueryValueExW RegQueryInfoKeyW RegEnumValueW GetNamedSecurityInfoW SetNamedSecurityInfoW RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW

ws2_32

WSAStartup WSACleanup

wintrust

WinVerifyTrust

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CryptQueryObject CryptMsgClose

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z ??0?$singleton@V?$extended_type_info_typeid@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@VBundleData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@VPackageData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??1?$codecvt_null@_W@archive@boost@@UEAA@XZ ??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VBundleData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@VBundleData@Serialization@Autodesk@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPackageData@Serialization@Autodesk@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@VPackageData@Serialization@Autodesk@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@VBundleData@Serialization@Autodesk@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@VBundleData@Serialization@Autodesk@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_iarchive@archive@boost@@VPackageData@Serialization@Autodesk@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vxml_iarchive@archive@boost@@VPackageData@Serialization@Autodesk@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vxml_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QEAA_NXZ ?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@V?$vector@VPackageData@Serialization@Autodesk@@V?$allocator@VPackageData@Serialization@Autodesk@@@std@@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@VBundleData@Serialization@Autodesk@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vxml_iarchive@archive@boost@@VPackageData@Serialization@Autodesk@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QEAAXXZ ?unlock@singleton_module@serialization@boost@@QEAAXXZ

Name

.text

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

454KB

Virtual Size

709KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

430KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_257967941bfb885ec9f3b0aead0f2dea_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

version

msi

shlwapi

authz

mpr

userenv

wtsapi32

secur32

kernel32

user32

shell32

ole32

oleaut32

advapi32

ws2_32

wintrust

crypt32

bcrypt

generic