2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 5.9MB
Sample261016-3r9exset4p
SHA256 3e24c619132e3eade70ff5dc512a8566adf9ef8ca72257f409c2d086fbf8ca90
MD5 09f09e578e3c32b748598619574d0b91
SHA1 0ef8fc88e52c58ef8193072b4402f0a2f5d11670
SHA512 5b92422f62bbbcabf7af4f7ad62ce6d76d24d91b52ea222af08772326939f7052bfe62131e7d3eba00638f5d4bc0a3a3afb23e3d833645fe00dbb3834202b41f
SSDEEP 98304:rY5tY4RMk6lxMOb56/tbN+kgYbJzl8o+k:r2Mk6lxMOMVbN+kgExT+k
TLSH
T1F956CF57A7A901E8D866C23CC4678603E7B2BC151770A7CF0664627A1FB3AE25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 5.9MB

2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 7e7711dc8aa42bd770df02ca21a208f1
SHA256 3e24c619132e3eade70ff5dc512a8566adf9ef8ca72257f409c2d086fbf8ca90
MD5 09f09e578e3c32b748598619574d0b91
SHA1 0ef8fc88e52c58ef8193072b4402f0a2f5d11670
SHA512 5b92422f62bbbcabf7af4f7ad62ce6d76d24d91b52ea222af08772326939f7052bfe62131e7d3eba00638f5d4bc0a3a3afb23e3d833645fe00dbb3834202b41f
SSDEEP 98304:rY5tY4RMk6lxMOb56/tbN+kgYbJzl8o+k:r2Mk6lxMOMVbN+kgExT+k
TLSH
T1F956CF57A7A901E8D866C23CC4678603E7B2BC151770A7CF0664627A1FB3AE25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2271508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MBVpnTunnel\bin\x64\Release\MBVpnTunnelService.pdb

ws2_32

ioctlsocket send recv select WSASetLastError getservbyname getservbyport setsockopt getsockname connect gethostbyaddr ntohs inet_ntoa inet_addr htons WSACleanup WSAStartup htonl WSAGetLastError getsockopt sendto recvfrom getpeername shutdown socket gethostbyname InetPtonW inet_ntop closesocket

crypt32

CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CertGetNameStringW CertOpenStore CertCloseStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertOpenSystemStoreW CryptMsgGetParam CryptDecodeObjectEx CryptDecodeObject CertDuplicateCertificateContext

kernel32

GetWindowsDirectoryW GetLongPathNameW QueryDosDeviceW GetFileInformationByHandle GetFullPathNameW SetFilePointer SetFileAttributesW GetFileSizeEx SetEndOfFile DeleteFileW IsWow64Process GetNativeSystemInfo GetLogicalDriveStringsW CreateProcessW GetExitCodeProcess GetCurrentThread GetFileSize lstrcmpA GetFileAttributesW GetFileAttributesExW CreateDirectoryW RemoveDirectoryW FormatMessageW GlobalAlloc GlobalFree ExpandEnvironmentStringsW LocalAlloc GetDriveTypeW GetLogicalDrives OutputDebugStringW GetCurrentThreadId GetStdHandle FindNextFileW GetModuleHandleA GetCurrentDirectoryW InitializeCriticalSectionAndSpinCount ResetEvent ReleaseMutex CreateMutexW TerminateProcess GetStartupInfoW CreateFileW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetEnvironmentVariableW SetEnvironmentVariableW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualProtect VirtualFree GetFileType GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetOEMCP IsValidCodePage HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation FileTimeToSystemTime GetSystemTime GetLocalTime GetTickCount SetThreadPriority OpenThread LocalFree GetCurrentProcess GetSystemInfo VerifyVersionInfoW VerSetConditionMask GetVersionExW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte CloseThreadpool CloseThreadpoolCleanupGroup CloseThreadpoolWork CloseThreadpoolCleanupGroupMembers SubmitThreadpoolWork CreateThreadpoolWork CreateNamedPipeW WaitForSingleObject SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CreateThreadpoolCleanupGroup CreateThreadpool ConnectNamedPipe WriteFile ReadFile DisconnectNamedPipe FlushFileBuffers WaitForMultipleObjects GetOverlappedResult CancelIoEx SetLastError SetEvent CreateEventW HeapFree GetProcessHeap HeapAlloc MapViewOfFile OpenFileMappingW GetProcessTimes OpenProcess UnmapViewOfFile GetCurrentProcessId CloseHandle DecodePointer GetModuleHandleW DeleteCriticalSection InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection SwitchToThread Sleep GetProcAddress LoadLibraryW FreeLibrary FindClose FindFirstFileW GetLastError GetSystemDirectoryW GetModuleFileNameW GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx GetConsoleOutputCP GetCommandLineW GetCommandLineA SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx RaiseException QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo LCMapStringEx EncodePointer FindFirstFileExW GetStringTypeW SystemTimeToFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize WriteConsoleW GetExitCodeThread

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

RegCloseKey RegQueryValueExW RegEnumKeyExW IsTextUnicode OpenProcessToken CryptReleaseContext CryptAcquireContextW CryptCreateHash CryptDestroyHash OpenThreadToken AllocateAndInitializeSid FreeSid ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CreateWellKnownSid GetSidSubAuthority GetSidSubAuthorityCount AreAllAccessesGranted MapGenericMask GetSecurityDescriptorDacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegQueryInfoKeyW RegLoadAppKeyW RegLoadKeyW RegEnumValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW TreeSetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW DeleteAce GetExplicitEntriesFromAclW RegOpenKeyExW

shell32

SHGetFolderPathW

oleaut32

VariantClear

mpr

WNetGetConnectionW

netapi32

NetWkstaGetInfo NetApiBufferFree

sfc

SfcIsFileProtected

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetProcessImageFileNameW

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptImportKeyPair BCryptDestroyHash BCryptCreateHash BCryptGetProperty BCryptDestroyKey

wintrust

WinVerifyTrust CryptCATAdminReleaseContext CryptCATAdminAcquireContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext

authz

AuthzFreeContext AuthzInitializeContextFromSid AuthzAccessCheck AuthzInitializeResourceManager AuthzFreeResourceManager

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_09f09e578e3c32b748598619574d0b91_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

ws2_32

crypt32

kernel32

user32

advapi32

shell32

oleaut32

mpr

netapi32

sfc

version

psapi

bcrypt

wintrust

authz

generic