2026-10-19_56b384188bda5e79ae2aa77615b26566_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_56b384188bda5e79ae2aa77615b26566_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.0MB
Sample261020-ynlggada85
SHA256 361eb430536dda6d08bb483bab8dc474869a52e5c553ed4ae2af72d5745b0947
MD5 56b384188bda5e79ae2aa77615b26566
SHA1 6135484be057a851e6f54d38f3a371c192e8de92
SHA512 0a28ca0cfe83880c77f3dd272c25daaabae75817e8c8b2f62a65d2ef54be3cf00cedc457c88a0c4494467666a85896751e4e863d1b5afaf23e47039750c8e2e4
SSDEEP 49152:F97S0By5ojNf2xLy4Vo2Sab+BEfw5MEaxVdOizQ6DlyxVRzHTw4TCdPx7XQT+Mhg:FpSaxfwzYaiqozan7XXMMHJej2jF
TLSH
T11416AE56A3A401E9C4BBD178C9674913E7F1B80613709FDB03B096752F236E2AE3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_56b384188bda5e79ae2aa77615b26566_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-19_56b384188bda5e79ae2aa77615b26566_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.0MB

2026-10-19_56b384188bda5e79ae2aa77615b26566_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 99d902055ead807ab81760f1c19157cc
SHA256 361eb430536dda6d08bb483bab8dc474869a52e5c553ed4ae2af72d5745b0947
MD5 56b384188bda5e79ae2aa77615b26566
SHA1 6135484be057a851e6f54d38f3a371c192e8de92
SHA512 0a28ca0cfe83880c77f3dd272c25daaabae75817e8c8b2f62a65d2ef54be3cf00cedc457c88a0c4494467666a85896751e4e863d1b5afaf23e47039750c8e2e4
SSDEEP 49152:F97S0By5ojNf2xLy4Vo2Sab+BEfw5MEaxVdOizQ6DlyxVRzHTw4TCdPx7XQT+Mhg:FpSaxfwzYaiqozan7XXMMHJej2jF
TLSH
T11416AE56A3A401E9C4BBD178C9674913E7F1B80613709FDB03B096752F236E2AE3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1388624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\build_crashpad\crashpad\out\x64\crashpad_handler.pdb

kernel32

DisconnectNamedPipe PostQueuedCompletionStatus CreateEventW Sleep SetEvent UnregisterWaitEx CreateIoCompletionPort ConnectNamedPipe OpenEventA CreateEventA ExitProcess FindClose GetStdHandle SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType CreateDirectoryW FindFirstFileExW RemoveDirectoryW GetFileTime FindNextFileW SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW ReleaseSemaphore CreateSemaphoreW FormatMessageA GetSystemTimeAsFileTime LocalFree GetTimeZoneInformation IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW Wow64GetThreadContext SuspendThread ResumeThread GetThreadContext DuplicateHandle GetThreadLocale GetUserDefaultLCID CreateProcessW GetFileSize SwitchToThread IsWow64Process WriteProcessMemory GetExitCodeThread VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent GetModuleHandleA UnmapViewOfFile CreateFileMappingW MapViewOfFile GlobalMemoryStatusEx SizeofResource LockResource GlobalAlloc GlobalFree GetQueuedCompletionStatus IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock VirtualProtect GetSystemDefaultLCID TerminateProcess RegisterWaitForSingleObject GetFileInformationByHandleEx SetLastError LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection GetLocalTime FormatMessageW GetCurrentThreadId GetFileSizeEx ReadFile WideCharToMultiByte MultiByteToWideChar GetSystemInfo CreateFileA OpenEventW DeviceIoControl GetCurrentProcess GetProcAddress CreateThread LoadLibraryW DeleteFileW GetFileAttributesW WaitForSingleObject WritePrivateProfileSectionW GetPrivateProfileStringW CreateFileW GetPrivateProfileSectionW WriteFile CreateTimerQueue DeleteTimerQueueTimer DeleteTimerQueueEx CreateTimerQueueTimer GetProcessTimes CloseHandle OpenProcess OutputDebugStringW GetCurrentProcessId GetDiskFreeSpaceExW GetProcessId OutputDebugStringA WritePrivateProfileStringW SetUnhandledExceptionFilter GetModuleHandleW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer ReadConsoleA LoadLibraryA ConvertFiberToThread DeleteFiber VirtualQueryEx MoveFileW HeapQueryInformation GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetStdHandle SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary RtlPcToFileHeader RtlUnwindEx InitializeSListHead UnhandledExceptionFilter GetCPInfo CompareStringEx InitOnceExecuteOnce LCMapStringEx GetLocaleInfoEx EncodePointer SleepConditionVariableSRW GetStringTypeW AreFileApisANSI SystemTimeToFileTime CreateWaitableTimerW SetWaitableTimer WaitForMultipleObjectsEx MapViewOfFileEx SetFilePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx SetProcessShutdownParameters SetConsoleCtrlHandler GetModuleFileNameW HeapFree FindResourceExW GetFileAttributesExW WaitForSingleObjectEx GetTickCount GetThreadId GetStartupInfoW CreateFileMappingA GetFullPathNameW GetFileInformationByHandle FindFirstFileW LCMapStringW WriteConsoleW ReadConsoleW SetConsoleMode ResetEvent ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSection WakeAllConditionVariable TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetConsoleMode GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency FileTimeToSystemTime FlushFileBuffers PeekNamedPipe RtlUnwind

advapi32

CryptDecrypt RegOpenKeyExA RegQueryValueExA RegCloseKey RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW ImpersonateNamedPipeClient RevertToSelf SystemFunction036 CryptAcquireContextW CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW InitializeSecurityDescriptor SetSecurityDescriptorDacl BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW RegQueryValueExW

user32

GetUserObjectInformationW GetProcessWindowStation DefWindowProcW GetMessageW KillTimer SetTimer EnableWindow EndPaint BeginPaint InvalidateRect TrackPopupMenu DialogBoxParamW GetSysColorBrush DrawIconEx CreatePopupMenu GetMenuItemCount GetWindowThreadProcessId GetWindowTextW PostMessageW DestroyWindow DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW MapWindowPoints SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen OpenClipboard ShowWindow SetWindowTextW SendMessageW SetWindowPos GetWindowRect CallWindowProcW SetWindowLongPtrW CreateWindowExW GetWindowLongPtrW DispatchMessageW RegisterClassW TranslateMessage UnregisterClassW MessageBoxW EndDialog LoadImageW GetKeyState RegisterClipboardFormatW DestroyMenu IsWindow GetWindowTextLengthW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpWriteData WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpQueryHeaders

powrprof

CallNtPowerInformation

ole32

CoTaskMemFree StringFromCLSID CoCreateGuid OleInitialize OleUninitialize DoDragDrop

shlwapi

PathRemoveFileSpecW PathFileExistsW

shell32

SHGetDesktopFolder ShellExecuteW ord155 SHGetFileInfoW SHGetSpecialFolderPathA SHBindToParent

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon InitCommonControlsEx ImageList_Create

gdi32

SetBkMode SetTextColor CreateFontW SelectObject GetStockObject DeleteObject

oleaut32

SysStringByteLen SysAllocStringByteLen SysAllocString SysStringLen SysFreeString

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

ws2_32

recv WSACleanup WSASetLastError send WSAGetLastError closesocket

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

crypt32

CertFreeCertificateContext CertCloseStore CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore CertEnumCertificatesInStore CertDuplicateCertificateContext

bcrypt

BCryptGenRandom

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

805KB

Virtual Size

805KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=205, id=261, version=33145,

count=10, id=259, version=33145,

count=24, id=260, version=33145,

count=4, id=253, version=34321,

count=19, id=260, version=34321,

count=12, id=259, version=34321,

count=104, id=261, version=34321,

count=29, id=261, version=33523,

count=27, id=260, version=33523,

count=28, id=260, version=33811,

count=1, id=262, version=33145,

count=1, id=259, version=27045,

count=539, id=1, productName=Unmarked objects,

count=43, id=257, version=33145,

count=504, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=259, version=34444,

count=207, id=265, version=34444,

count=1, id=256, version=34444,

count=1, id=255, version=34444,

count=1, id=258, version=34444,