2026-10-01_20fbec0f2ad01094681dad75ecd5472d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_20fbec0f2ad01094681dad75ecd5472d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 12.6MB
Sample261002-w6caeaverg
SHA256 c510cfdaf48526bbc078389f7f81f742dee233ed6422857a382a8a1cca8485c7
MD5 20fbec0f2ad01094681dad75ecd5472d
SHA1 49b896e36393f1c658e04da58ed1ee676e783ac4
SHA512 da92568be3a28d6f96d7c0991cfdd67ee8f0ba5361578535ae0cc98adb2688ecff2ed417353f448f926bb52fbc1eade68f2bd15a98a58e9ff9bdaeb15a0ef24e
SSDEEP 196608:5DWbLSYIYNj3XJy2KfMQC9cIurMU2/Y4YVcrhmv:5D+LSYIYNj3XJy2KfMQvrC3YVUmv
TLSH
T104D62A157B5B95A8C0ABC07482878A675D7030CB0B35BAFF558496392F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_20fbec0f2ad01094681dad75ecd5472d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-10-01_20fbec0f2ad01094681dad75ecd5472d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 12.6MB

2026-10-01_20fbec0f2ad01094681dad75ecd5472d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6b84c9d427c5499f9d9b775470eeb7ab
SHA256 c510cfdaf48526bbc078389f7f81f742dee233ed6422857a382a8a1cca8485c7
MD5 20fbec0f2ad01094681dad75ecd5472d
SHA1 49b896e36393f1c658e04da58ed1ee676e783ac4
SHA512 da92568be3a28d6f96d7c0991cfdd67ee8f0ba5361578535ae0cc98adb2688ecff2ed417353f448f926bb52fbc1eade68f2bd15a98a58e9ff9bdaeb15a0ef24e
SSDEEP 196608:5DWbLSYIYNj3XJy2KfMQC9cIurMU2/Y4YVcrhmv:5D+LSYIYNj3XJy2KfMQvrC3YVUmv
TLSH
T104D62A157B5B95A8C0ABC07482878A675D7030CB0B35BAFF558496392F7ABF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6373328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

esea_ac.pdb

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RegGetValueW RegQueryValueExW RegCloseKey EventSetInformation EventRegister EventUnregister EventWriteTransfer

ntdll

RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile NtWriteFile

kernel32

IsProcessorFeaturePresent LoadLibraryW TlsAlloc TlsGetValue IsDebuggerPresent TlsSetValue TlsFree GetSystemTimeAsFileTime SleepConditionVariableSRW GetFullPathNameW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead UnhandledExceptionFilter FindNextFileW QueryPerformanceFrequency GetTempPathW WaitForMultipleObjects SetUnhandledExceptionFilter FlsSetValue GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeviceIoControl GetFinalPathNameByHandleW CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose lstrlenW LoadLibraryA EncodePointer FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetModuleHandleW RaiseException GetExitCodeProcess GetEnvironmentStringsW TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetUserDefaultUILanguage LCIDToLocaleName GetFileInformationByHandleEx SetFileTime CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WriteFileEx SleepEx ReadFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter HeapReAlloc GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW RtlUnwindEx FreeLibrary DuplicateHandle GetCurrentThreadId GetCurrentProcess GetStdHandle SetFileInformationByHandle SetLastError WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle GetConsoleMode GetFileInformationByHandle ReleaseMutex DeleteCriticalSection CreateFileW RtlPcToFileHeader GetOverlappedResult ReadFile InitializeCriticalSectionAndSpinCount LoadLibraryExA HeapAlloc GetQueuedCompletionStatusEx PostQueuedCompletionStatus FormatMessageW CreateDirectoryW CreateIoCompletionPort IsThreadAFiber CreateMutexW

user32

PostThreadMessageW VkKeyScanW DestroyMenu GetMessageA PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW DrawIconEx CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar MapVirtualKeyW CreatePopupMenu CreateMenu DrawTextW GetWindowDC OffsetRect GetMenuBarInfo GetMenuItemInfoW SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx FlashWindowEx RegisterClassExW CreateIcon GetAsyncKeyState GetKeyboardState RedrawWindow SetForegroundWindow DispatchMessageA EnumChildWindows SetWindowTextW GetWindowTextW GetWindowTextLengthW PostMessageW EnumDisplayMonitors MonitorFromPoint GetMenu DefWindowProcW MapVirtualKeyExW ToUnicodeEx GetKeyState GetRawInputData DestroyWindow SystemParametersInfoA SetPropW GetKeyboardLayout SetWindowDisplayAffinity ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu DestroyIcon ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SendInput RegisterRawInputDevices TranslateAcceleratorW FindWindowW RegisterWindowMessageA GetWindow SetParent SendMessageW MapWindowPoints SetFocus ShowWindow AdjustWindowRect DispatchMessageW ChangeDisplaySettingsExW PeekMessageW EnableWindow IsWindowEnabled ReleaseDC GetDC IsProcessDPIAware SetCursor GetWindowRect GetParent FindWindowExW SetWindowRgn TranslateMessage IsWindowVisible SetWindowLongPtrW GetWindowLongPtrW SetWindowPlacement GetWindowPlacement GetMessageW SetWindowPos InvalidateRgn CreateWindowExW GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos LoadCursorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient GetUpdateRect ValidateRect RegisterClassW RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx IsIconic

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

shlwapi

SHCreateMemStream

ole32

CoUninitialize CoTaskMemFree CoTaskMemAlloc CoInitialize RevokeDragDrop RegisterDragDrop CoInitializeEx CoCreateFreeThreadedMarshaler OleInitialize CoCreateInstance

gdi32

CreateSolidBrush SelectObject CreateDIBSection SetBkMode SetTextColor GetDeviceCaps BitBlt CreateCompatibleDC CreateRectRgn DeleteObject DeleteDC CombineRgn

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

DragQueryFileW SHAppBarMessage ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconGetRect SHOpenFolderAndSelectItems DragFinish ILCreateFromPathW ILFree ShellExecuteExW Shell_NotifyIconW

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-crt-math-l1-1-0

pow round __setusermatherr roundf trunc floor

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s strcmp wcsncmp wcslen _wcsicmp strlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _crt_atexit _c_exit _initterm _initterm_e _register_thread_local_exe_atexit_callback exit _exit _get_initial_narrow_environment _cexit _initialize_narrow_environment terminate _register_onexit_function _configure_narrow_argv _initialize_onexit_table _seh_filter_exe __p___argc _set_app_type abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode _callnewh malloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_20fbec0f2ad01094681dad75ecd5472d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

bcryptprimitives

advapi32

ntdll

kernel32

user32

comctl32

shlwapi

ole32

gdi32

dwmapi

api-ms-win-core-synch-l1-2-0

shell32

oleaut32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic