2026-09-30_a1637995b657c5af97018060441d294d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_a1637995b657c5af97018060441d294d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 13.1MB
Sample261001-kw5nesfe64
SHA256 6300cdf9b8230f9562dbceec749ae539acd96fc22844144be25a56fbec6a982a
MD5 a1637995b657c5af97018060441d294d
SHA1 b28dc9f462901e47e742f18c627990164daef0c2
SHA512 23fb2f0215622c961957d4babd65e7875e34703a2763af426f63bebce64144ebff51cc1ed1d42d0003f2c7b8e8fc39841066729d8162e40cd704a1b0619006ce
SSDEEP 393216:SW4wYobEkohIDmonw6KySJHGBo8PQsMQMX8kT+oCOeZS64z:p+fIDf3SJHIPQ68+OSB4
TLSH
T1D3D60186A26901E8CF36D1B4C917521BE2313CCC1730A7DBA7985E516F933F8AA7DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_a1637995b657c5af97018060441d294d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-30_a1637995b657c5af97018060441d294d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 13.1MB

2026-09-30_a1637995b657c5af97018060441d294d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 81c0c6c222f44e1b4df04c794a7a55ef
SHA256 6300cdf9b8230f9562dbceec749ae539acd96fc22844144be25a56fbec6a982a
MD5 a1637995b657c5af97018060441d294d
SHA1 b28dc9f462901e47e742f18c627990164daef0c2
SHA512 23fb2f0215622c961957d4babd65e7875e34703a2763af426f63bebce64144ebff51cc1ed1d42d0003f2c7b8e8fc39841066729d8162e40cd704a1b0619006ce
SSDEEP 393216:SW4wYobEkohIDmonw6KySJHGBo8PQsMQMX8kT+oCOeZS64z:p+fIDf3SJHIPQ68+OSB4
TLSH
T1D3D60186A26901E8CF36D1B4C917521BE2313CCC1730A7DBA7985E516F933F8AA7DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2045648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\antonio\Downloads\hyperx + lua completo by clarencio (1)\hyperx + lua completo by clarencio\x64\Release\Steam.pdb

d3dx9_43

D3DXMatrixTranspose D3DXVec3Transform D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

SizeofResource WriteProcessMemory GetCurrentProcess Thread32Next GetFullPathNameA Thread32First FindResourceA SuspendThread ResumeThread K32EnumProcessModulesEx GetExitCodeThread GetTempPathA Process32NextW MoveFileExA LockResource DeleteFileA Process32FirstW K32GetModuleBaseNameA K32GetModuleInformation LoadResource GetCurrentProcessId GetModuleHandleW GetThreadTimes K32EnumProcessModules OpenThread FindResourceW GetStartupInfoW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx VerifyVersionInfoA GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc GetFileSizeEx QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress GlobalAlloc MultiByteToWideChar GetExitCodeProcess CreateEventA GetOverlappedResult CancelIoEx CreateFileA GetModuleHandleA WriteFile WaitNamedPipeA ReadFile CreateRemoteThread WaitForSingleObject ReadProcessMemory VirtualProtectEx CloseHandle SetUnhandledExceptionFilter WakeAllConditionVariable Process32Next GetTickCount64 Sleep VirtualAllocEx VirtualFreeEx GetTickCount Process32First Module32Next Module32First OpenProcess CreateToolhelp32Snapshot GlobalLock QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA WideCharToMultiByte GlobalUnlock GetSystemTimeAsFileTime GetLocaleInfoEx GlobalFree GetLastError InitializeSListHead

user32

GetForegroundWindow TranslateMessage GetKeyNameTextA MapVirtualKeyA SetWindowDisplayAffinity GetWindowThreadProcessId GetWindowRect GetWindowTextA GetWindowLongPtrA GetKeyState GetAsyncKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard mouse_event SetForegroundWindow UpdateWindow GetClipboardData SetClipboardData DispatchMessageA DestroyWindow EnumDisplayMonitors CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow SetWindowLongA MessageBoxA GetMonitorInfoA MoveWindow DefWindowProcA FindWindowA PostQuitMessage PeekMessageA SetLayeredWindowAttributes

advapi32

CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenProcessToken AdjustTokenPrivileges RegGetValueA GetCurrentHwProfileA CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation

shell32

ShellExecuteA SHGetKnownFolderPath

ole32

CoTaskMemFree

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Cnd_signal ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_wait _Thrd_id _Thrd_join ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z __crtLCMapStringW ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Random_device@std@@YAIXZ _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xbad_alloc@std@@YAXXZ

ws2_32

recv getsockopt getsockname getpeername connect bind WSAGetLastError send htons closesocket ntohs socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet setsockopt select getaddrinfo freeaddrinfo recvfrom ntohl gethostname sendto

normaliz

IdnToAscii

crypt32

CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertGetCertificateChain CertOpenStore CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain

wldap32

ord211 ord41 ord217 ord143 ord46 ord50 ord60 ord45 ord22 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

wininet

InternetCloseHandle InternetOpenA HttpSendRequestA InternetConnectA InternetReadFile HttpOpenRequestA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __std_exception_destroy __std_exception_copy __std_terminate strstr strchr __std_type_info_compare wcsstr __RTtypeid strrchr longjmp memcpy memmove memset memchr memcmp __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh calloc malloc realloc

api-ms-win-crt-string-l1-1-0

tolower _stricmp isupper strnlen strspn strcspn wcscpy_s _wcsnicmp strcmp wcslen strpbrk _strdup strncpy_s toupper strncpy strncmp isalnum strlen _wcslwr_s

api-ms-win-crt-stdio-l1-1-0

fseek __acrt_iob_func _wfopen _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc __stdio_common_vsscanf setvbuf fgetpos _open fwrite _set_fmode _lseeki64 fgets __stdio_common_vsnprintf_s fgetc __p__commode fclose _read fflush fputc _write feof __stdio_common_vfprintf _close fputs fopen __stdio_common_vsprintf ftell

api-ms-win-crt-convert-l1-1-0

strtoul strtoull atof mbstowcs wcstol strtoll strtol atoi strtod

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _errno abort __sys_nerr _beginthreadex terminate _initialize_narrow_environment strerror _initialize_onexit_table _register_thread_local_exe_atexit_callback _register_onexit_function _c_exit _crt_atexit _exit _getpid _initterm_e _initterm _get_narrow_winmain_command_line exit _set_app_type _seh_filter_exe _cexit

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_stat64 _fstat64 _unlink _access _unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-math-l1-1-0

acosf __setusermatherr atan2f ceilf cos _hypotf log expf sqrtf logf _dsign pow fmodf powf cosf sin sinf roundf

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_a1637995b657c5af97018060441d294d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

d3dx9_43

d3dx11_43

d3d11

kernel32

user32

advapi32

shell32

ole32

msvcp140

ws2_32

normaliz

crypt32

wldap32

ntdll

wininet

imm32

d3dcompiler_47

dwmapi

winmm

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic