2026-10-05_6bc6c640eeb68c366e8589780d97c85d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_6bc6c640eeb68c366e8589780d97c85d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar
Size 43.1MB
Sample261006-2e2zmsgw6y
SHA256 3d51bb9c9ddbff1afff10ba1674e82d4ba25e151692fee397d835cb7f8ae5e9d
MD5 6bc6c640eeb68c366e8589780d97c85d
SHA1 da07625165ce66493d17e6c72435de5f69d773ad
SHA512 5167dc9aeb36ffaa1afe4362d57109447416d82af8e1e8f047cc82e1c4c028f90b5d8b63a04cb3eb0fc886cc07903e0be8f0e1202a5fee39c662d233e3b1daa5
SSDEEP 393216:v1l1fs7lY80hMtz7oZIkByrQo5QTcolvpoIgFHNeE9fn:tl1YE0zhkByrQ9TcoTojB9v
TLSH
T16AA7AE1676A801F8D0BBD17CCA979A13F772744903716BEB02A406651FABBE09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_6bc6c640eeb68c366e8589780d97c85d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

File Explorer

2026-10-05_6bc6c640eeb68c366e8589780d97c85d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

.exe 43.1MB

2026-10-05_6bc6c640eeb68c366e8589780d97c85d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

IMPHASH 5f44a8eadc3ce163f789ee302c1159b8
SHA256 3d51bb9c9ddbff1afff10ba1674e82d4ba25e151692fee397d835cb7f8ae5e9d
MD5 6bc6c640eeb68c366e8589780d97c85d
SHA1 da07625165ce66493d17e6c72435de5f69d773ad
SHA512 5167dc9aeb36ffaa1afe4362d57109447416d82af8e1e8f047cc82e1c4c028f90b5d8b63a04cb3eb0fc886cc07903e0be8f0e1202a5fee39c662d233e3b1daa5
SSDEEP 393216:v1l1fs7lY80hMtz7oZIkByrQo5QTcolvpoIgFHNeE9fn:tl1YE0zhkByrQ9TcoTojB9v
TLSH
T16AA7AE1676A801F8D0BBD17CCA979A13F772744903716BEB02A406651FABBE09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1467392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dinput8

DirectInput8Create

d2d1

ord1

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

winmm

timeBeginPeriod timeEndPeriod

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

kernel32

GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA SizeofResource SetDefaultDllDirectories AddDllDirectory GetCommandLineW WriteFile CreateMutexW CreateFileW GetLastError GetFileAttributesA GetFileAttributesExW GetCurrentThread LockResource LoadResource FindResourceW GetThreadContext Beep LocalFree SetDllDirectoryW IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentProcessId CreateProcessA LoadLibraryW GetTickCount GetSystemDirectoryW SetThreadPriority RaiseException GetSystemInfo VirtualProtect GlobalFree LoadLibraryExA QueryFullProcessImageNameW Sleep CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileInformationByHandle AcquireSRWLockExclusive FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA WideCharToMultiByte ExitProcess AcquireSRWLockShared GlobalLock GlobalAlloc MultiByteToWideChar VirtualQuery GetModuleHandleW SleepConditionVariableSRW WakeAllConditionVariable InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter Process32FirstW Process32NextW GetTickCount64 GetModuleHandleA ReleaseMutex GetTempPathW GetModuleFileNameW GetCurrentProcess SetPriorityClass CreateDirectoryW CloseHandle CreateToolhelp32Snapshot OpenProcess GetFileInformationByHandleEx ReleaseSRWLockExclusive GetCurrentThreadId ReleaseSRWLockShared FindNextFileW

user32

SetLayeredWindowAttributes keybd_event EnumDisplayMonitors GetMonitorInfoW mouse_event SendInput GetShellWindow UpdateLayeredWindow GetDesktopWindow SetWindowLongA GetWindowTextA GetWindowLongA EnumWindows GetKeyState GetMessageExtraInfo GetCapture ClientToScreen GetKeyboardLayout SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData BringWindowToTop PostMessageW DispatchMessageA LoadCursorA DestroyWindow IsWindowVisible SetActiveWindow SetWindowLongPtrW SetWindowRgn FillRect CreateWindowExW TranslateMessage DestroyMenu DefWindowProcA AttachThreadInput TrackMouseEvent LoadIconA GetClientRect PeekMessageA PostQuitMessage PtInRect UpdateWindow SetForegroundWindow InvalidateRect PeekMessageW ScreenToClient GetSystemMetrics UnregisterClassW InsertMenuW IsIconic BeginPaint DispatchMessageW GetAsyncKeyState ShowWindow TrackPopupMenu RegisterClassExW GetWindowLongPtrW CreatePopupMenu EndPaint GetWindowThreadProcessId GetWindowRect DefWindowProcW DrawTextA SendMessageTimeoutW GetDC SetWindowPos GetIconInfo PrivateExtractIconsW GetClassLongPtrW RedrawWindow DestroyIcon SetWindowDisplayAffinity GetForegroundWindow ReleaseDC GetCursorPos

gdi32

CreateCompatibleDC RoundRect CreateSolidBrush SetStretchBltMode MoveToEx SelectClipRgn CreatePen LineTo SetBkMode SetTextColor GetDIBits GetStockObject StretchDIBits SelectObject CreateFontA CreateCompatibleBitmap BitBlt SetBrushOrgEx CreateDIBSection DeleteDC CreateRoundRectRgn GetObjectA DeleteObject

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA RegOpenKeyExW RegQueryValueExW

shell32

ExtractIconExW SHGetFolderPathW ShellExecuteA ShellExecuteExA Shell_NotifyIconW ShellExecuteW ExtractIconW SHGetFileInfoW

ole32

CoUninitialize CoInitializeEx

msvcp140

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ _Mtx_unlock _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Syserror_map@std@@YAPEBDH@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_id _Thrd_join _Thrd_hardware_concurrency ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??7ios_base@std@@QEBA_NXZ _Thrd_yield ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ

ws2_32

htons htonl closesocket recv select socket listen send WSAStartup accept bind setsockopt

crypt32

CryptProtectData CryptUnprotectData

winhttp

WinHttpReceiveResponse WinHttpOpenRequest WinHttpReadData WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpSetTimeouts WinHttpQueryHeaders

dxgi

CreateDXGIFactory1

shlwapi

ord12

gdiplus

GdipDisposeImage GdipCreateBitmapFromStream GdiplusStartup GdipBitmapLockBits GdipSetSmoothingMode GdipDeletePath GdipCreateLineBrushFromRectI GdipDisposeImageAttributes GdipDeleteBrush GdipCloneImage GdiplusShutdown GdipAddPathArcI GdipSetImageAttributesColorMatrix GdipBitmapUnlockBits GdipCreatePath GdipSetInterpolationMode GdipFillPath GdipSetPixelOffsetMode GdipClosePathFigure GdipCreateImageAttributes GdipFree GdipCreateFromHDC GdipFillRectangleI GdipDeleteGraphics GdipDrawImageRectRectI GdipAlloc

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

xinput1_4

ord2

bcrypt

BCryptGenRandom

dwrite

DWriteCreateFactory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove memcpy longjmp strrchr strchr strstr _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoull strtoul strtod atof strtol atoi strtoll

api-ms-win-crt-runtime-l1-1-0

_errno _beginthreadex _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _initialize_onexit_table _crt_atexit abort terminate _configure_narrow_argv _initialize_narrow_environment _register_onexit_function

api-ms-win-crt-string-l1-1-0

strcmp strncpy strncpy_s strcpy_s toupper wcscpy_s isspace isalnum isalpha tolower wcslen _stricmp strlen strncmp

api-ms-win-crt-stdio-l1-1-0

fwrite __stdio_common_vsprintf fgetpos setvbuf ungetc fsetpos fgetc fread __stdio_common_vswprintf_s __stdio_common_vsscanf _fseeki64 _get_stream_buffer_pointers _set_fmode ftell __acrt_iob_func fseek fclose __p__commode fflush _wfopen __stdio_common_vfprintf fputc

api-ms-win-crt-time-l1-1-0

_time64 _mkgmtime64

api-ms-win-crt-math-l1-1-0

logf fmod fmodf cosf powf sinf _hypotf acosf sqrtf pow __setusermatherr _dsign log atan2f

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_6bc6c640eeb68c366e8589780d97c85d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar

dinput8

d2d1

dwmapi

winmm

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

ws2_32

crypt32

winhttp

dxgi

shlwapi

gdiplus

imm32

d3dcompiler_47

xinput1_4

bcrypt

dwrite

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic