2026-10-02_6019382dfcea4fd399754a16e8cf76d6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_6019382dfcea4fd399754a16e8cf76d6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 1.8MB
Sample261003-np72rays3p
SHA256 1adca221e98f8a87037d5a0138e09f31a8b22ac5f994241b1690805f408d30ba
MD5 6019382dfcea4fd399754a16e8cf76d6
SHA1 0d5a1d8b3ed6bbf126e3146fd9f26b3100b8033c
SHA512 d066c9076f4f1dc7544b01c89d490a9ceb5f2964ca0e479d5228d0e0c76086cf45da65e113c64ca9502e531cd0936309ecd4f6f01b62afd464c7b388371d5f11
SSDEEP 24576:iwKE/HMVMz+HHBN0mz8d39VHm0vI0McbMYBmmxXWlyq0+qG7TuLp0C:i2EVVHBN3ifbgcbDQHTqGuF
TLSH
T1F895BF1A329843F4E1B7E179C6868F85E6B27805472197CB03E457AA2F377A14E3F319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_6019382dfcea4fd399754a16e8cf76d6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-10-02_6019382dfcea4fd399754a16e8cf76d6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.8MB

2026-10-02_6019382dfcea4fd399754a16e8cf76d6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 181600dc906b4ad13f41d3d152851084
SHA256 1adca221e98f8a87037d5a0138e09f31a8b22ac5f994241b1690805f408d30ba
MD5 6019382dfcea4fd399754a16e8cf76d6
SHA1 0d5a1d8b3ed6bbf126e3146fd9f26b3100b8033c
SHA512 d066c9076f4f1dc7544b01c89d490a9ceb5f2964ca0e479d5228d0e0c76086cf45da65e113c64ca9502e531cd0936309ecd4f6f01b62afd464c7b388371d5f11
SSDEEP 24576:iwKE/HMVMz+HHBN0mz8d39VHm0vI0McbMYBmmxXWlyq0+qG7TuLp0C:i2EVVHBN3ifbgcbDQHTqGuF
TLSH
T1F895BF1A329843F4E1B7E179C6868F85E6B27805472197CB03E457AA2F377A14E3F319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

405876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\work\xl\XLBugReport_VS2015\bugreport\component\xl9_bugreport\x64\ReleaseDll\XLBugReport.pdb

dbghelp

SymSetOptions SymGetOptions SymFunctionTableAccess64 SymGetModuleBase64 SymInitializeW MiniDumpReadDumpStream StackWalk64

ws2_32

htons inet_addr recv send setsockopt connect ntohs socket gethostbyname WSAStartup WSACleanup getpeername getsockname closesocket WSAGetLastError WSAAsyncGetHostByName WSAAsyncSelect WSACancelAsyncRequest

minizip

zipCloseFileInZip zipOpen zipOpenNewFileInZip zipWriteInFileInZip zipClose

libeay32

ord197 ord196 ord1804 ord464

libcurl

curl_global_cleanup curl_slist_append curl_easy_init curl_easy_perform curl_easy_cleanup curl_easy_getinfo curl_easy_setopt curl_global_init

kernel32

RtlUnwindEx RtlPcToFileHeader FlsFree FlsSetValue FlsGetValue FlsAlloc GetCurrentThread GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread CreateFileW CloseHandle CreateFileMappingW MapViewOfFile MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetTempPathW RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject GetExitCodeProcess GetSystemTime FindResourceExW LoadResource LockResource SizeofResource FindResourceW CopyFileW SystemTimeToTzSpecificLocalTime DecodePointer InitializeCriticalSection CreateThread GetCurrentThreadId TerminateThread GetModuleFileNameA OutputDebugStringW SetLastError SetErrorMode FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW TlsAlloc GlobalUnlock GlobalLock lstrcmpiW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW FileTimeToLocalFileTime ReadFile FileTimeToDosDateTime InitializeCriticalSectionEx IsBadCodePtr SetFileTime WriteFile MoveFileW SystemTimeToFileTime GetFileAttributesExW GetFileSizeEx FormatMessageW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx LocalFree LCMapStringEx FormatMessageA LoadLibraryExA VirtualFree TlsSetValue VirtualAlloc FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent TlsGetValue IsThreadAFiber VirtualProtect TlsFree GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe FileTimeToSystemTime ExitThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleMode ReadConsoleW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW InterlockedFlushSList SetStdHandle GetConsoleOutputCP SetFilePointerEx SetConsoleCtrlHandler FindFirstFileExW IsValidCodePage GetACP ResumeThread GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlushFileBuffers SetEndOfFile WriteConsoleW GlobalAlloc RtlUnwind

user32

ShowCursor GetCursorPos MapWindowPoints GetSysColor InflateRect GetWindowLongW MessageBeep MessageBoxW GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW GetWindowLongPtrW SetWindowLongPtrW GetParent GetWindow LoadBitmapW LoadCursorW LoadImageW SystemParametersInfoW MonitorFromWindow SetCursor InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DrawTextW GetSystemMetrics IsWindowEnabled KillTimer SetTimer GetActiveWindow EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetDlgItemTextW GetDlgItem EndDialog DialogBoxParamW SetWindowPos ShowWindow DestroyWindow IsWindow CallWindowProcW DefWindowProcW SendMessageW PostThreadMessageW PeekMessageW UnregisterClassW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW wsprintfW GetMonitorInfoW PostMessageW RegisterClassExW GetClassInfoExW CreateWindowExW GetDesktopWindow CharNextW

gdi32

OffsetWindowOrgEx SetWindowOrgEx ExtTextOutW GetObjectW SetTextColor SetBkMode SetBkColor BitBlt CreateCompatibleDC CreateFontIndirectW CreateRectRgnIndirect DeleteDC DeleteObject GetStockObject GetWindowOrgEx Rectangle SelectObject ExtSelectClipRgn

advapi32

TraceEvent RegCreateKeyExW RegDeleteKeyW RegDeleteValueW GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

shell32

ord165 SHCreateDirectoryExW ShellExecuteW ShellExecuteExW

ole32

CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CoCreateInstance

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantClear VarUI4FromStr

shlwapi

PathAppendW PathCombineA PathFileExistsW

comctl32

_TrackMouseEvent InitCommonControlsEx

Name

.text

Size

943KB

Virtual Size

942KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

656KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_6019382dfcea4fd399754a16e8cf76d6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc_vidar

dbghelp

ws2_32

minizip

libeay32

libcurl

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic