2026-10-01_a92e4ec0a81d6924f927599cac8fe7f7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_a92e4ec0a81d6924f927599cac8fe7f7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
Size 7.3MB
Sample261003-x84m4sxtft
SHA256 b85c22dd0cf22916cc8c984a344ae6deb654f36abe0e92a3b148fe5ad6e27761
MD5 a92e4ec0a81d6924f927599cac8fe7f7
SHA1 e448577e1bdf96660a672d283920a5580e604baa
SHA512 ba3585311228bd52d9524f1364d6c76d542532ef197286fbaf68046cc9d5d9b2f58d391d5eb0ca0e3aa7f96059db0b5b30b93e45e6903dd5d7c1df38f77ddb66
SSDEEP 49152:hGtlqBJkIU6iYVwASONbUU98C3uoIsqiomCyWQlwRIXDpNkkEYCCIxElRBMMbMSD:tl+6ORuGRIXlI6V074ZuiAS63Ubbup
TLSH
T102769D56A7A450ECD5B7C178CA568617E7F2BC0503719BCF06A0A66A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_a92e4ec0a81d6924f927599cac8fe7f7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

File Explorer

2026-10-01_a92e4ec0a81d6924f927599cac8fe7f7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

.exe 7.3MB

2026-10-01_a92e4ec0a81d6924f927599cac8fe7f7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

IMPHASH 69b6c6fd69c528979d29c1de21ded386
SHA256 b85c22dd0cf22916cc8c984a344ae6deb654f36abe0e92a3b148fe5ad6e27761
MD5 a92e4ec0a81d6924f927599cac8fe7f7
SHA1 e448577e1bdf96660a672d283920a5580e604baa
SHA512 ba3585311228bd52d9524f1364d6c76d542532ef197286fbaf68046cc9d5d9b2f58d391d5eb0ca0e3aa7f96059db0b5b30b93e45e6903dd5d7c1df38f77ddb66
SSDEEP 49152:hGtlqBJkIU6iYVwASONbUU98C3uoIsqiomCyWQlwRIXDpNkkEYCCIxElRBMMbMSD:tl+6ORuGRIXlI6V074ZuiAS63Ubbup
TLSH
T102769D56A7A450ECD5B7C178CA568617E7F2BC0503719BCF06A0A66A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7483392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetExitCodeProcess GetCurrentProcess WaitForSingleObject SystemTimeToFileTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType WriteFile UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ExitProcess RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GlobalAlloc SizeofResource LockResource LoadResource OpenProcess GetModuleFileNameW GetProductInfo GetVersionExA SetStdHandle GetFullPathNameW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress GetCurrentThreadId Sleep CreateSymbolicLinkW DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW InitializeSListHead SleepConditionVariableSRW GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SetProcessAffinityMask GetProcessHeaps DebugBreak SetUnhandledExceptionFilter GetProcessAffinityMask GetSystemInfo GetLastError ProcessIdToSessionId CreateProcessW OutputDebugStringW SetCurrentDirectoryW SetEnvironmentVariableW SetThreadAffinityMask TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId OpenEventA SetEvent SetErrorMode CloseHandle ResumeThread SuspendThread GetExitCodeThread TerminateThread SetThreadPriority OpenThread GetCurrentThread RemoveDirectoryA GetFileAttributesA MultiByteToWideChar LeaveCriticalSection EnterCriticalSection OutputDebugStringA IsProcessorFeaturePresent GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetDateFormatW GetTimeFormatW GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent CreateEventA WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent TerminateProcess GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree RtlCaptureStackBackTrace GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread

user32

GetDC CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW DestroyWindow GetWindowThreadProcessId EnumWindows GetUserObjectInformationW IsWindowVisible ReleaseDC GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer SetTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow MsgWaitForMultipleObjects SetWindowPos MoveWindow GetProcessWindowStation AllowSetForegroundWindow MessageBoxA ShowWindow

gdi32

SelectObject TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor RemoveFontMemResourceEx AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegSetValueExW RegQueryValueExW ReportEventW

shell32

ord680 SHGetFileInfoW CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

comctl32

InitCommonControlsEx

psapi

GetProcessMemoryInfo GetModuleFileNameExW GetModuleInformation

version

VerQueryValueW

crypt32

CertOpenStore CertGetCertificateChain CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

send htonl htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError recv WSARecvFrom WSASend WSASendTo WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup connect bind WSAIoctl setsockopt getsockname WSARecv ioctlsocket

wsock32

ord1142

bcrypt

BCryptGenRandom

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdf17

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_a92e4ec0a81d6924f927599cac8fe7f7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic