2026-10-10_3ea8ce6e5dbdbe41beec599889b81fc1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_3ea8ce6e5dbdbe41beec599889b81fc1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar
Size 44.0MB
Sample261011-trtj2ada85
SHA256 d37a2ca8d21488479ab1fe9eaa88c8a65463e5764eadff66cb5072e0351f36be
MD5 3ea8ce6e5dbdbe41beec599889b81fc1
SHA1 b05ac24733d496d6bd20a2def54560631cd2442e
SHA512 3cabbfb5365ad7a5fd233cbc8d1bbdbdff3f000122beef0df2e4693d5a23a308ab8957325c314272faf4544ae5ba33a347c9fcde7efc99c08c2049f85f60169b
SSDEEP 786432:RY+vtHLn3XllDzpB4golOCZiqfEHDTD3hat4pUQ2h:BuOCw/3oM
TLSH
T13CA7F066A25E8B0DEF6275348183932393F17CC95761CFC7AAC44D235E2F1E4BA2E245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_3ea8ce6e5dbdbe41beec599889b81fc1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

File Explorer

2026-10-10_3ea8ce6e5dbdbe41beec599889b81fc1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

.exe 44.0MB

2026-10-10_3ea8ce6e5dbdbe41beec599889b81fc1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

IMPHASH 1c9f874a836e8c6d138aa32500c2989d
SHA256 d37a2ca8d21488479ab1fe9eaa88c8a65463e5764eadff66cb5072e0351f36be
MD5 3ea8ce6e5dbdbe41beec599889b81fc1
SHA1 b05ac24733d496d6bd20a2def54560631cd2442e
SHA512 3cabbfb5365ad7a5fd233cbc8d1bbdbdff3f000122beef0df2e4693d5a23a308ab8957325c314272faf4544ae5ba33a347c9fcde7efc99c08c2049f85f60169b
SSDEEP 786432:RY+vtHLn3XllDzpB4golOCZiqfEHDTD3hat4pUQ2h:BuOCw/3oM
TLSH
T13CA7F066A25E8B0DEF6275348183932393F17CC95761CFC7AAC44D235E2F1E4BA2E245
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8470416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\TG GAMER\Desktop\BYTE Resell\cylone\thirdparty\imgui\examples\example_win32_directx11\Release\example_win32_directx11.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

VirtualAllocEx ExitProcess WideCharToMultiByte CreateRemoteThread Module32NextW CreateDirectoryA VirtualFreeEx SetProcessWorkingSetSize GetExitCodeProcess LocalFree GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReadFile GetFileSizeEx CreateFileW GetFileAttributesW GetCommandLineA SetFileAttributesW DeleteFileA SetFileAttributesA GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW GetComputerNameA FindFirstFileExW FindFirstFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc GetFileAttributesExW Module32FirstW SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx ReleaseSRWLockExclusive LockResource LoadLibraryA GetSystemDirectoryA AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable GetProcAddress FindResourceW LoadResource CreateFileA QueryFullProcessImageNameA Process32NextW GetFileAttributesA GetLastError GetTempPathA Sleep GetExitCodeThread CloseHandle MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetModuleHandleA WaitForSingleObject FindClose GetEnvironmentVariableA WriteFile GetCurrentProcess FindFirstFileA WriteProcessMemory SizeofResource GetModuleFileNameA GetFileInformationByHandle Process32FirstW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter FindNextFileW

user32

ShowWindow MoveWindow TrackMouseEvent GetClientRect GetCapture SetLayeredWindowAttributes SetCapture LoadCursorW GetForegroundWindow ReleaseCapture SetCursorPos ClientToScreen SetCursor IsWindowUnicode PostMessageA DefWindowProcW DestroyWindow GetKeyboardLayout GetWindowRect GetCursorPos ReleaseDC GetDC GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData EmptyClipboard CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW GetAsyncKeyState DispatchMessageW PeekMessageW TranslateMessage LoadIconW EnumDisplayDevicesW PostQuitMessage UpdateWindow OpenClipboard CloseClipboard ScreenToClient

gdi32

DeleteDC SelectObject DeleteObject BitBlt CreateCompatibleDC CreateCompatibleBitmap

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameA RegOpenKeyExW RegDeleteValueA RegQueryValueExW ConvertSidToStringSidA OpenProcessToken GetTokenInformation

shell32

ShellExecuteExA ShellExecuteA

ole32

CoInitializeEx CreateStreamOnHGlobal CoUninitialize

msvcp140

??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_detach _Thrd_join _Mtx_unlock _Cnd_broadcast ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1_Lockit@std@@QEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Cnd_signal _Query_perf_frequency ?_Xinvalid_argument@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Query_perf_counter ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_function_call@std@@YAXXZ _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

wininet

HttpSendRequestA InternetCloseHandle InternetOpenA InternetConnectA InternetReadFile InternetCrackUrlA HttpOpenRequestA

urlmon

URLDownloadToFileA

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

winhttp

WinHttpQueryHeaders WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

crypt32

CryptProtectData CryptUnprotectData

gdiplus

GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipGetImageEncodersSize GdipDisposeImage

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler __std_exception_destroy __std_exception_copy _purecall __std_terminate strstr strchr strrchr longjmp memcpy memmove memset memchr memcmp

api-ms-win-crt-stdio-l1-1-0

fputc _get_stream_buffer_pointers __p__commode fgetc __stdio_common_vsprintf_s __stdio_common_vsprintf fclose ftell __acrt_iob_func _fseeki64 fflush fseek __stdio_common_vfprintf fread _wfopen_s fsetpos ungetc _wfopen __stdio_common_vsscanf _set_fmode fgetpos fwrite setvbuf

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode realloc free

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table _wassert terminate _beginthreadex system abort _seh_filter_exe _set_app_type _errno _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _register_thread_local_exe_atexit_callback _c_exit __p___argc __p___argv _cexit _exit

api-ms-win-crt-math-l1-1-0

ceilf cosf roundf fmodf sqrtf acosf powf __setusermatherr sinf

api-ms-win-crt-string-l1-1-0

strcmp strncpy isdigit strncmp isalnum tolower wcslen strlen toupper

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

strftime _time64 _gmtime64_s

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-convert-l1-1-0

strtoul _wtoi strtol strtoull strtoll

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_3ea8ce6e5dbdbe41beec599889b81fc1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

wininet

urlmon

d3dcompiler_47

dwmapi

imm32

winhttp

bcrypt

crypt32

gdiplus

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic