2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 5.5MB
Sample261003-trcxaascpc
SHA256 7da619d39b259c0234cdd8fefb5cab6fba9842608c35ff3aa90420c90f72e8d6
MD5 1e8907826f619ae2bf58fd65a43cf160
SHA1 f951ecc79c0fefb2986433d389c0a928503d254d
SHA512 9a7aeee0500fbb963a2d4a5e1dc25592d38874c63a6a572f8f7e0e995332815b2827486da30e2ec4b2272eaa1e7618a57b22901077cf559e22fac6a282cac42d
SSDEEP 98304:irZUzLy1+3zPpFyjSGuRPQX8BjY5YB2YyjlcP/2:YmLy1+3zPpFyjLKPQXqYWZ332
TLSH
T18E46BF17A7A501E8C876C238C55A8603E7B2BC1557709BCF06A4567A2FB3AE54F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 5.5MB

2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH c36da8c99f60478851cefcef686e4886
SHA256 7da619d39b259c0234cdd8fefb5cab6fba9842608c35ff3aa90420c90f72e8d6
MD5 1e8907826f619ae2bf58fd65a43cf160
SHA1 f951ecc79c0fefb2986433d389c0a928503d254d
SHA512 9a7aeee0500fbb963a2d4a5e1dc25592d38874c63a6a572f8f7e0e995332815b2827486da30e2ec4b2272eaa1e7618a57b22901077cf559e22fac6a282cac42d
SSDEEP 98304:irZUzLy1+3zPpFyjSGuRPQX8BjY5YB2YyjlcP/2:YmLy1+3zPpFyjLKPQXqYWZ332
TLSH
T18E46BF17A7A501E8C876C238C55A8603E7B2BC1557709BCF06A4567A2FB3AE54F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2425916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB4_MbamBgNativeMsg\bin\x64\Release\MbamBgNativeMsg.pdb

kernel32

SetEvent Sleep SwitchToThread HeapAlloc HeapFree GetProcessHeap LocalFree CreateFileW CloseHandle DisconnectNamedPipe CancelSynchronousIo ResetEvent WaitForSingleObject WaitForSingleObjectEx CreateMutexA CreateEventW WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId CreateThread OpenProcess GlobalFree MultiByteToWideChar MoveFileExW CopyFileW WideCharToMultiByte SetFilePointer FlushFileBuffers GetFileSizeEx ReadFile WriteFile GetFileInformationByHandle GetProcAddress GetModuleHandleW LoadLibraryW FormatMessageW CallNamedPipeW CreateNamedPipeW ConnectNamedPipe GetOverlappedResult GetWindowsDirectoryW GetDriveTypeW FreeLibrary FindNextFileW FindClose OpenThread SetThreadPriority IsWow64Process GetNativeSystemInfo GetSystemInfo SetLastError GetLogicalDriveStringsW QueryDosDeviceW GetCurrentThread GetModuleFileNameW GetSystemDirectoryW GetTickCount GetLocalTime LeaveCriticalSection SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation FindFirstFileW GetFileAttributesW CreateDirectoryW RemoveDirectoryW DeleteFileW GetVersionExW VerSetConditionMask VerifyVersionInfoW GetFileSize lstrcmpA OutputDebugStringW GetCurrentThreadId SetEndOfFile GetStdHandle GetModuleHandleA GetCurrentDirectoryW GetSystemTimeAsFileTime ReleaseMutex CreateMutexW InitializeCriticalSectionAndSpinCount TerminateProcess GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW SetEnvironmentVariableW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualProtect VirtualFree GetFileType GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx GetLastError GetSystemTime DecodePointer RaiseException VirtualQuery LoadLibraryExA IsDebuggerPresent GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency FindFirstFileExW GetFullPathNameW EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx LoadLibraryExW ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler PeekNamedPipe SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP SetFilePointerEx SetStdHandle HeapReAlloc HeapSize IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

generic