2026-09-30_4a1e52206fc04c351d021ff0c1f06f4b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_4a1e52206fc04c351d021ff0c1f06f4b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar
Size 12.2MB
Sample261001-scfh7aee84
SHA256 07cd467e28e37ef1feb7c3b87018b0479460aeb8db5d20f688f50afc1a0f3f2f
MD5 4a1e52206fc04c351d021ff0c1f06f4b
SHA1 6da2d67a2a96c298ed822bea3df09541eed37d20
SHA512 a7dcb81fec131bbcbbf6287fb9af47d359be26d2bb6a11fe0d0d3cf9a33d01a15a321011bb02f1d837cdbb3be8a8ac9ef7c33b0093b01acb183a68645249f565
SSDEEP 196608:EcO5glmNZR6GW4kvxoK/52j7lymRHJEP79CzDm:Ec3lmNZR6GW4kvxotlvET9im
TLSH
T1D9D6BE1AA22800EED567C138C686E617E3B17C23137187CB16A8766A1F33EE15E7F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_4a1e52206fc04c351d021ff0c1f06f4b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

File Explorer

2026-09-30_4a1e52206fc04c351d021ff0c1f06f4b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

.exe 12.2MB

2026-09-30_4a1e52206fc04c351d021ff0c1f06f4b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

IMPHASH 413b3609ba82376c14aaa35bd1f85241
SHA256 07cd467e28e37ef1feb7c3b87018b0479460aeb8db5d20f688f50afc1a0f3f2f
MD5 4a1e52206fc04c351d021ff0c1f06f4b
SHA1 6da2d67a2a96c298ed822bea3df09541eed37d20
SHA512 a7dcb81fec131bbcbbf6287fb9af47d359be26d2bb6a11fe0d0d3cf9a33d01a15a321011bb02f1d837cdbb3be8a8ac9ef7c33b0093b01acb183a68645249f565
SSDEEP 196608:EcO5glmNZR6GW4kvxoK/52j7lymRHJEP79CzDm:Ec3lmNZR6GW4kvxotlvET9im
TLSH
T1D9D6BE1AA22800EED567C138C686E617E3B17C23137187CB16A8766A1F33EE15E7F751
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12705792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GlobalAlloc GlobalUnlock GlobalLock LocalAlloc LocalFree VerifyVersionInfoW MultiByteToWideChar RaiseException GetCurrentThread GetCurrentThreadId SetThreadPriority GetModuleHandleExW WideCharToMultiByte GetModuleFileNameW GetSystemDirectoryA GetCurrentProcessId Sleep SetLastError WriteFile MoveFileExW GetFullPathNameW DeleteFileW CreateFileA CreateDirectoryW VerSetConditionMask GlobalFree GetFileAttributesW FindFirstFileW FindClose CreateFileW OutputDebugStringA FormatMessageA GetCurrentProcess CreateEventA WaitForSingleObject ResetEvent SetEvent GetLastError LeaveCriticalSection EnterCriticalSection DeviceIoControl GetModuleHandleA OpenProcess GetExitCodeProcess CloseHandle FreeLibrary LoadLibraryA MoveFileExA GetProcAddress WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc SetStdHandle SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation HeapValidate HeapSize SetConsoleCtrlHandler ExitProcess GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe FreeLibraryAndExitThread ExitThread RtlUnwind RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext GetCPInfo LCMapStringEx DecodePointer EncodePointer GetStringTypeW InitOnceComplete InitOnceBeginInitialize GetTickCount64 SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive GetTimeFormatW GetDateFormatW GetCurrentDirectoryW FindNextFileW GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA RtlVirtualUnwind GetStdHandle GetEnvironmentVariableW GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree DeleteFiber QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount InitializeCriticalSectionEx QueryPerformanceFrequency WaitForSingleObjectEx GetEnvironmentVariableA SleepEx GetFileSizeEx ReadFile GetSystemTime SystemTimeToFileTime IsDebuggerPresent TerminateProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW GlobalMemoryStatusEx VirtualAlloc VirtualFree GetModuleFileNameA GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetProcessAffinityMask DuplicateHandle TryEnterCriticalSection SwitchToThread CreateThread OpenThread GetExitCodeThread SetThreadAffinityMask SetUnhandledExceptionFilter LoadLibraryExW LoadLibraryW DebugBreak GetProcessHeaps SetProcessAffinityMask SetEnvironmentVariableW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointer SetFileTime

user32

EnumWindows GetWindowThreadProcessId GetDesktopWindow MessageBoxA GetWindowTextLengthA EmptyClipboard CloseClipboard OpenClipboard SetDlgItemTextA FlashWindowEx IsWindowVisible GetWindowRect SetClipboardData GetDlgItemInt SetDlgItemInt GetDlgItem EndDialog DialogBoxParamA SetWindowPos wsprintfA MessageBoxW GetProcessWindowStation GetUserObjectInformationW

advapi32

DeregisterEventSource RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegCloseKey RegisterEventSourceW ReportEventW CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

shell32

CommandLineToArgvW

ole32

CLSIDFromString

oleaut32

VariantClear

ws2_32

getsockname WSAGetLastError ntohl htonl select __WSAFDIsSet gethostname WSAEnumNetworkEvents bind closesocket ioctlsocket htons recvfrom sendto setsockopt WSAEventSelect WSAIoctl WSASendMsg getaddrinfo freeaddrinfo getsockopt ntohs recv send WSASetLastError accept connect listen WSACloseEvent WSACreateEvent inet_ntop inet_pton getpeername WSAStartup WSACleanup socket

psapi

GetProcessMemoryInfo

winmm

timeEndPeriod timeBeginPeriod

sdl3_image

IMG_FreeAnimation IMG_Load_IO IMG_isSVG IMG_LoadAnimation_IO

bcrypt

BCryptGenRandom

crypt32

CryptStringToBinaryA CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.7MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

251KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

108KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcd7cb

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_4a1e52206fc04c351d021ff0c1f06f4b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

psapi

winmm

sdl3_image

bcrypt

crypt32

generic