2026-10-22_bb7b1961886b5dcd30b5512f3c985134_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_bb7b1961886b5dcd30b5512f3c985134_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
Size 892KB
Sample261023-2n85bavy8n
SHA256 d9bc068ecb0c8c361409d01f8d31dfd1f02a4d9a1195a3e8e4a9275e92b4f782
MD5 bb7b1961886b5dcd30b5512f3c985134
SHA1 109ded6b39fd8ca06d929347d398fc355218ccbe
SHA512 3c0414e9290742ae96b7902215fc504166b6a130dcdecc31ffa6ae7ab6f38189fababffbdfc1746f01da942a6aa6cf088cafd7f89b0c2b89bcd83bd87e0ae11b
SSDEEP 12288:uZAUoTcA6RSyA28+396W9Wqa+JRmub0b5cLVzVCnEI601P3R9fW9ah:uZADTARzA2B6M01PhNH
TLSH
T149157E37678402FDD0BAD27A8D869952F772B80A07A1AEDF16D041621F971D89E3F313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_bb7b1961886b5dcd30b5512f3c985134_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-22_bb7b1961886b5dcd30b5512f3c985134_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

.exe 892KB

2026-10-22_bb7b1961886b5dcd30b5512f3c985134_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 60dbe036970bf8bda8fffe950de7756a
SHA256 d9bc068ecb0c8c361409d01f8d31dfd1f02a4d9a1195a3e8e4a9275e92b4f782
MD5 bb7b1961886b5dcd30b5512f3c985134
SHA1 109ded6b39fd8ca06d929347d398fc355218ccbe
SHA512 3c0414e9290742ae96b7902215fc504166b6a130dcdecc31ffa6ae7ab6f38189fababffbdfc1746f01da942a6aa6cf088cafd7f89b0c2b89bcd83bd87e0ae11b
SSDEEP 12288:uZAUoTcA6RSyA28+396W9Wqa+JRmub0b5cLVzVCnEI601P3R9fW9ah:uZADTARzA2B6M01PhNH
TLSH
T149157E37678402FDD0BAD27A8D869952F772B80A07A1AEDF16D041621F971D89E3F313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

362640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

advapi32

RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExA GetSecurityDescriptorDacl RegDeleteValueA RegQueryValueExA SetNamedSecurityInfoW

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpSendRequest

bcrypt

BCryptDestroyKey BCryptExportKey BCryptDecrypt BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptDestroySecret BCryptGetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptFinalizeKeyPair BCryptSecretAgreement BCryptDeriveKey BCryptImportKeyPair BCryptSetProperty

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteExW Shell_NotifyIconW SHFileOperationW SHCreateItemFromParsingName SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemAlloc CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx

user32

SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW AdjustWindowRect GetWindowRect GetClientRect SetWindowTextW SetForegroundWindow UpdateWindow TrackPopupMenu GetParent DestroyMenu CreatePopupMenu GetSystemMetrics FindWindowW SetFocus IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW LoadImageW GetAsyncKeyState ChangeWindowMessageFilterEx AppendMenuW

shlwapi

PathFindFileNameW PathCombineW ord12

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

MultiByteToWideChar WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileType LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RtlUnwindEx InitializeSListHead TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime InitializeCriticalSectionEx WakeAllConditionVariable RaiseException RtlPcToFileHeader SleepConditionVariableSRW GetCommandLineW SetEnvironmentVariableW GetFileAttributesW CloseHandle GetLastError WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateProcessW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW LocalFree lstrcmpW WideCharToMultiByte CreateFileW DeleteFileW WriteFile GetTempPathW GetExitCodeProcess WinExec ReadFile PeekNamedPipe GetEnvironmentVariableW CreateDirectoryW GetFileSizeEx SetFileAttributesW QueryPerformanceCounter OpenProcess GetTickCount64 CopyFileW MoveFileExW GetComputerNameW IsDebuggerPresent GetVolumeInformationW QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive

Name

.text

Size

452KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_bb7b1961886b5dcd30b5512f3c985134_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

dwmapi

advapi32

winhttp

bcrypt

shell32

ole32

user32

shlwapi

version

kernel32

generic