2026-09-30_17b4b4662c34cdfa3f9a710b43b83f0a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_17b4b4662c34cdfa3f9a710b43b83f0a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 13.1MB
Sample261001-wtdmpsty3n
SHA256 6dd17603fcae661a0736b778164d954fc850b55b911b187acc5963af8c467800
MD5 17b4b4662c34cdfa3f9a710b43b83f0a
SHA1 95ec58650fa653036d5c6de9c64ab2e5dedff966
SHA512 95d6fd900247faeb2de121212344fef92eb30001e081dbd57a0b608e24cb5fe923efcc56e92a6ee12758ae25b17b8dc28cd5926805b8388ddb02804903b726fe
SSDEEP 393216:8cVXYobEkohIDmonw6KySJHGBo8PQsMQMX8kT+okYeZS64z:x+fIDf3SJHIPQ68YYSB4
TLSH
T1C5D60186A26900ECCF36D1B4C913521BE2313CCC1721ABDBA7995E515F933F86A7DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_17b4b4662c34cdfa3f9a710b43b83f0a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-30_17b4b4662c34cdfa3f9a710b43b83f0a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 13.1MB

2026-09-30_17b4b4662c34cdfa3f9a710b43b83f0a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 3f3e024ee76edc212317f9ae29303801
SHA256 6dd17603fcae661a0736b778164d954fc850b55b911b187acc5963af8c467800
MD5 17b4b4662c34cdfa3f9a710b43b83f0a
SHA1 95ec58650fa653036d5c6de9c64ab2e5dedff966
SHA512 95d6fd900247faeb2de121212344fef92eb30001e081dbd57a0b608e24cb5fe923efcc56e92a6ee12758ae25b17b8dc28cd5926805b8388ddb02804903b726fe
SSDEEP 393216:8cVXYobEkohIDmonw6KySJHGBo8PQsMQMX8kT+okYeZS64z:x+fIDf3SJHIPQ68YYSB4
TLSH
T1C5D60186A26900ECCF36D1B4C913521BE2313CCC1721ABDBA7995E515F933F86A7DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2053216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\antonio\Downloads\hyperx + lua completo by clarencio (1)\hyperx + lua completo by clarencio\x64\Release\Steam.pdb

d3dx9_43

D3DXMatrixTranspose D3DXVec3Normalize D3DXVec3Transform

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

SizeofResource WriteProcessMemory GetCurrentProcess Thread32Next GetFullPathNameA Thread32First FindResourceA SuspendThread ResumeThread K32EnumProcessModulesEx GetExitCodeThread GetTempPathA Process32NextW MoveFileExA LockResource DeleteFileA Process32FirstW K32GetModuleBaseNameA K32GetModuleInformation LoadResource GetCurrentProcessId GetModuleHandleW GetThreadTimes K32EnumProcessModules OpenThread FindResourceW QueryPerformanceCounter InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable GetFileSizeEx HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx GetFileInformationByHandleEx FreeLibrary SleepEx GetSystemDirectoryA VerifyVersionInfoA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId LocalFree GetLocaleInfoEx CreateDirectoryW GetTickCount64 FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetLastError CreateToolhelp32Snapshot OpenProcess Module32First Module32Next Process32First GetTickCount VirtualFreeEx VirtualAllocEx GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetExitCodeProcess CreateEventA GetOverlappedResult CancelIoEx CreateFileA GetModuleHandleA WriteFile WaitNamedPipeA ReadFile CreateRemoteThread WaitForSingleObject ReadProcessMemory VirtualProtectEx AreFileApisANSI CreateFile2 CloseHandle DeleteCriticalSection Process32Next Sleep

user32

SetForegroundWindow FindWindowA PostQuitMessage PeekMessageA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow GetMonitorInfoA MessageBoxA SetWindowLongA ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW EnumDisplayMonitors DestroyWindow DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard mouse_event GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState GetWindowLongPtrA GetWindowTextA GetAsyncKeyState UpdateWindow GetForegroundWindow OpenClipboard GetWindowThreadProcessId GetKeyNameTextA MapVirtualKeyA SetWindowDisplayAffinity GetWindowRect

advapi32

CryptAcquireContextA CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptImportKey CryptEncrypt CryptDestroyKey GetCurrentHwProfileA RegGetValueA AdjustTokenPrivileges OpenProcessToken GetTokenInformation

shell32

ShellExecuteA SHGetKnownFolderPath

ole32

CoTaskMemFree

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Cnd_signal ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ _Thrd_id _Thrd_join ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z __crtLCMapStringW ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ?_Random_device@std@@YAIXZ _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1_Lockit@std@@QEAA@XZ _Cnd_wait

ws2_32

bind WSAGetLastError send recv closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo ntohl gethostname sendto recvfrom freeaddrinfo WSASetLastError

normaliz

IdnToAscii

crypt32

CertFreeCertificateContext CertCloseStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertOpenStore CertFindCertificateInStore CertEnumCertificatesInStore

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

wininet

InternetCloseHandle InternetOpenA HttpSendRequestA InternetConnectA HttpOpenRequestA InternetReadFile

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __std_exception_destroy __std_exception_copy __std_terminate strstr strchr __std_type_info_compare wcsstr __RTtypeid strrchr longjmp memcpy memmove memset memchr memcmp __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc realloc _callnewh free

api-ms-win-crt-string-l1-1-0

tolower strspn strcspn isupper _strdup strnlen strpbrk toupper _wcsnicmp _wcslwr_s wcslen wcscpy_s strncmp strcmp strncpy isalnum isspace isdigit strncpy_s strlen _stricmp

api-ms-win-crt-stdio-l1-1-0

fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc _wfopen setvbuf fgetpos __stdio_common_vsscanf fwrite fopen fputs _set_fmode __stdio_common_vsnprintf_s fgetc feof fclose __stdio_common_vfprintf fflush fputc _write __p__commode fgets _read _lseeki64 _close __stdio_common_vsprintf _open

api-ms-win-crt-convert-l1-1-0

atoi strtoull strtod atof wcstol mbstowcs strtol strtoll strtoul

api-ms-win-crt-runtime-l1-1-0

strerror _getpid __sys_nerr _errno _beginthreadex terminate _register_thread_local_exe_atexit_callback abort _c_exit _configure_narrow_argv _exit _initterm_e _initialize_narrow_environment _initterm _get_narrow_winmain_command_line _initialize_onexit_table _set_app_type _seh_filter_exe _cexit exit _crt_atexit _register_onexit_function

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_stat64 _access _fstat64 _unlink _unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale ___lc_locale_name_func

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-math-l1-1-0

cos ceilf fmodf log roundf __setusermatherr logf pow _dsign powf cosf atan2f sin acosf _hypotf sinf expf sqrtf

api-ms-win-crt-time-l1-1-0

_localtime64_s _gmtime64 _time64 strftime

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_17b4b4662c34cdfa3f9a710b43b83f0a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

d3dx9_43

d3dx11_43

d3d11

kernel32

user32

advapi32

shell32

ole32

msvcp140

ws2_32

normaliz

crypt32

wldap32

ntdll

wininet

imm32

d3dcompiler_47

dwmapi

winmm

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic