2026-10-22_6e750a4f4249465f21171cad178ebe3b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_6e750a4f4249465f21171cad178ebe3b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 5.3MB
Sample261024-lbfdgaay8k
SHA256 cc9901ed7f6e923540ca37a136a9faead6548aedbb4c270f4e4a949ea613b9fb
MD5 6e750a4f4249465f21171cad178ebe3b
SHA1 c003e3599593045135f99ebedcc1e537d712e610
SHA512 57eae4c23c94125b9f23e9482f2a6422c50c04b98b39e10e9781f1e3e789648f499d1dd2619ecfc4fffb740e789e58490f9957b8926b905fe0964b0101c4885e
SSDEEP 98304:2Y5tY4RMk6lxMObK6/tbe7wRGpj360GkaP0hjuS+y:22Mk6lxMOLVbSF9K09aP4cy
TLSH
T15046BF57A7A901E8D866C23CC4678603E7B2BC110770A7CF0664627A1FB3AE65F3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_6e750a4f4249465f21171cad178ebe3b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-10-22_6e750a4f4249465f21171cad178ebe3b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 5.3MB

2026-10-22_6e750a4f4249465f21171cad178ebe3b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 7e7711dc8aa42bd770df02ca21a208f1
SHA256 cc9901ed7f6e923540ca37a136a9faead6548aedbb4c270f4e4a949ea613b9fb
MD5 6e750a4f4249465f21171cad178ebe3b
SHA1 c003e3599593045135f99ebedcc1e537d712e610
SHA512 57eae4c23c94125b9f23e9482f2a6422c50c04b98b39e10e9781f1e3e789648f499d1dd2619ecfc4fffb740e789e58490f9957b8926b905fe0964b0101c4885e
SSDEEP 98304:2Y5tY4RMk6lxMObK6/tbe7wRGpj360GkaP0hjuS+y:22Mk6lxMOLVbSF9K09aP4cy
TLSH
T15046BF57A7A901E8D866C23CC4678603E7B2BC110770A7CF0664627A1FB3AE65F3E715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2271508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MBVpnTunnel\bin\x64\Release\MBVpnTunnelService.pdb

ws2_32

ioctlsocket send recv select WSASetLastError getservbyname getservbyport setsockopt getsockname connect gethostbyaddr ntohs inet_ntoa inet_addr htons WSACleanup WSAStartup htonl WSAGetLastError getsockopt sendto recvfrom getpeername shutdown socket gethostbyname InetPtonW inet_ntop closesocket

crypt32

CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CertGetNameStringW CertOpenStore CertCloseStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertOpenSystemStoreW CryptMsgGetParam CryptDecodeObjectEx CryptDecodeObject CertDuplicateCertificateContext

kernel32

GetWindowsDirectoryW GetLongPathNameW QueryDosDeviceW GetFileInformationByHandle GetFullPathNameW SetFilePointer SetFileAttributesW GetFileSizeEx SetEndOfFile DeleteFileW IsWow64Process GetNativeSystemInfo GetLogicalDriveStringsW CreateProcessW GetExitCodeProcess GetCurrentThread GetFileSize lstrcmpA GetFileAttributesW GetFileAttributesExW CreateDirectoryW RemoveDirectoryW FormatMessageW GlobalAlloc GlobalFree ExpandEnvironmentStringsW LocalAlloc GetDriveTypeW GetLogicalDrives OutputDebugStringW GetCurrentThreadId GetStdHandle FindNextFileW GetModuleHandleA GetCurrentDirectoryW InitializeCriticalSectionAndSpinCount ResetEvent ReleaseMutex CreateMutexW TerminateProcess GetStartupInfoW CreateFileW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetEnvironmentVariableW SetEnvironmentVariableW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualProtect VirtualFree GetFileType GetACP GetSystemDirectoryA LoadLibraryA FormatMessageA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetOEMCP IsValidCodePage HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation FileTimeToSystemTime GetSystemTime GetLocalTime GetTickCount SetThreadPriority OpenThread LocalFree GetCurrentProcess GetSystemInfo VerifyVersionInfoW VerSetConditionMask GetVersionExW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte CloseThreadpool CloseThreadpoolCleanupGroup CloseThreadpoolWork CloseThreadpoolCleanupGroupMembers SubmitThreadpoolWork CreateThreadpoolWork CreateNamedPipeW WaitForSingleObject SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CreateThreadpoolCleanupGroup CreateThreadpool ConnectNamedPipe WriteFile ReadFile DisconnectNamedPipe FlushFileBuffers WaitForMultipleObjects GetOverlappedResult CancelIoEx SetLastError SetEvent CreateEventW HeapFree GetProcessHeap HeapAlloc MapViewOfFile OpenFileMappingW GetProcessTimes OpenProcess UnmapViewOfFile GetCurrentProcessId CloseHandle DecodePointer GetModuleHandleW DeleteCriticalSection InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection SwitchToThread Sleep GetProcAddress LoadLibraryW FreeLibrary FindClose FindFirstFileW GetLastError GetSystemDirectoryW GetModuleFileNameW GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx GetConsoleOutputCP GetCommandLineW GetCommandLineA SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx RaiseException QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo LCMapStringEx EncodePointer FindFirstFileExW GetStringTypeW SystemTimeToFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize WriteConsoleW GetExitCodeThread

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

RegCloseKey RegQueryValueExW RegEnumKeyExW IsTextUnicode OpenProcessToken CryptReleaseContext CryptAcquireContextW CryptCreateHash CryptDestroyHash OpenThreadToken AllocateAndInitializeSid FreeSid ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CreateWellKnownSid GetSidSubAuthority GetSidSubAuthorityCount AreAllAccessesGranted MapGenericMask GetSecurityDescriptorDacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegQueryInfoKeyW RegLoadAppKeyW RegLoadKeyW RegEnumValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW TreeSetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW DeleteAce GetExplicitEntriesFromAclW RegOpenKeyExW

shell32

SHGetFolderPathW

oleaut32

VariantClear

mpr

WNetGetConnectionW

netapi32

NetWkstaGetInfo NetApiBufferFree

sfc

SfcIsFileProtected

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetProcessImageFileNameW

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptImportKeyPair BCryptDestroyHash BCryptCreateHash BCryptGetProperty BCryptDestroyKey

wintrust

WinVerifyTrust CryptCATAdminReleaseContext CryptCATAdminAcquireContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext

authz

AuthzFreeContext AuthzInitializeContextFromSid AuthzAccessCheck AuthzInitializeResourceManager AuthzFreeResourceManager

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_6e750a4f4249465f21171cad178ebe3b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar

ws2_32

crypt32

kernel32

user32

advapi32

shell32

oleaut32

mpr

netapi32

sfc

version

psapi

bcrypt

wintrust

authz

generic