2026-10-10_cc5fee394fc6cbbd98a7e6f11add17cc_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_cc5fee394fc6cbbd98a7e6f11add17cc_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
Size 6.2MB
Sample261011-chh89stygv
SHA256 92146955d1c3681225c642aab911c8ec98c18674ecf9a2a72d35401ebec0c0ff
MD5 cc5fee394fc6cbbd98a7e6f11add17cc
SHA1 9e1f8517314ddf60b7be78cb32aa429d16bcede4
SHA512 7baf4e1f545af4e9ef9f991c6f61c8ccd4fadc8cab2ecc47e5d4ab99ca01f49cb36f5975ec8881782b692dfa78b97928cd6a2f3d0087e841cd45c8c0a97f2fe5
SSDEEP 98304:pl+6ORuGRIXl06V074ZuiASC3UbbuiX2yi2/xCX:nzO7+Xl06V074ZuiB8Ub6iX2yiiCX
TLSH
T11B66AE56A7A450E8D5B7C178CA468617E7F2BC1503719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_cc5fee394fc6cbbd98a7e6f11add17cc_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

File Explorer

2026-10-10_cc5fee394fc6cbbd98a7e6f11add17cc_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

.exe 6.2MB

2026-10-10_cc5fee394fc6cbbd98a7e6f11add17cc_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

IMPHASH 69b6c6fd69c528979d29c1de21ded386
SHA256 92146955d1c3681225c642aab911c8ec98c18674ecf9a2a72d35401ebec0c0ff
MD5 cc5fee394fc6cbbd98a7e6f11add17cc
SHA1 9e1f8517314ddf60b7be78cb32aa429d16bcede4
SHA512 7baf4e1f545af4e9ef9f991c6f61c8ccd4fadc8cab2ecc47e5d4ab99ca01f49cb36f5975ec8881782b692dfa78b97928cd6a2f3d0087e841cd45c8c0a97f2fe5
SSDEEP 98304:pl+6ORuGRIXl06V074ZuiASC3UbbuiX2yi2/xCX:nzO7+Xl06V074ZuiB8Ub6iX2yiiCX
TLSH
T11B66AE56A7A450E8D5B7C178CA468617E7F2BC1503719BCF06A0A67A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2007512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_win64\build\src\steamexe\win64\Release\steamexe.pdb

kernel32

GetExitCodeProcess GetCurrentProcess WaitForSingleObject SystemTimeToFileTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW GetSystemTime VerifyVersionInfoW SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType WriteFile UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ExitProcess RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc FindResourceA LocalFree LocalAlloc GlobalLock GlobalUnlock GlobalAlloc SizeofResource LockResource LoadResource OpenProcess GetModuleFileNameW GetProductInfo GetVersionExA SetStdHandle GetFullPathNameW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress GetCurrentThreadId Sleep CreateSymbolicLinkW DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW InitializeSListHead SleepConditionVariableSRW GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SetProcessAffinityMask GetProcessHeaps DebugBreak SetUnhandledExceptionFilter GetProcessAffinityMask GetSystemInfo GetLastError ProcessIdToSessionId CreateProcessW OutputDebugStringW SetCurrentDirectoryW SetEnvironmentVariableW SetThreadAffinityMask TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId OpenEventA SetEvent SetErrorMode CloseHandle ResumeThread SuspendThread GetExitCodeThread TerminateThread SetThreadPriority OpenThread GetCurrentThread RemoveDirectoryA GetFileAttributesA MultiByteToWideChar LeaveCriticalSection EnterCriticalSection OutputDebugStringA IsProcessorFeaturePresent GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileExW ReplaceFileW GetDateFormatW GetTimeFormatW GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent CreateEventA WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent TerminateProcess GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree RtlCaptureStackBackTrace GetCommandLineW DuplicateHandle RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread

user32

GetDC CreateWindowExW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW DestroyWindow GetWindowThreadProcessId EnumWindows GetUserObjectInformationW IsWindowVisible ReleaseDC GetMonitorInfoW MonitorFromWindow MonitorFromPoint LoadIconW LoadCursorW EnumChildWindows SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer SetTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow MsgWaitForMultipleObjects SetWindowPos MoveWindow GetProcessWindowStation AllowSetForegroundWindow MessageBoxA ShowWindow

gdi32

SelectObject TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor RemoveFontMemResourceEx AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegSetValueExW RegQueryValueExW ReportEventW

shell32

ord680 SHGetFileInfoW CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

comctl32

InitCommonControlsEx

psapi

GetProcessMemoryInfo GetModuleFileNameExW GetModuleInformation

version

VerQueryValueW

crypt32

CertOpenStore CertGetCertificateChain CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

send htonl htons ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError recv WSARecvFrom WSASend WSASendTo WSASocketA __WSAFDIsSet select WSASetLastError WSACleanup connect bind WSAIoctl setsockopt getsockname WSARecv ioctlsocket

wsock32

ord1142

bcrypt

BCryptGenRandom

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

798KB

Virtual Size

800KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_cc5fee394fc6cbbd98a7e6f11add17cc_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic