2026-10-25_c00818d77d8b63c238869e78b826fecb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_c00818d77d8b63c238869e78b826fecb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 2.6MB
Sample261026-q1f4hsft4j
SHA256 bd74adcfdb49941c5b87a367dfe02cb7979c9abb2b92179b1f2343459ec3161d
MD5 c00818d77d8b63c238869e78b826fecb
SHA1 bbe8996d1cd1ce1c81c6426015790ebc871242b6
SHA512 25f86e730c900f53eaf7ab07011b029c4625f403c7e9e26c456bc90006e4490cd11633fa6d37dc4d9ad79e400e9c6b13c9ca46572e991195735ca66067957ed9
SSDEEP 49152:5uGdEkwyV9+clmDXZa0jcCGg5kl3n4NivtHE0R3K1w98AeKBqHWwj:59comDgCGgalX4NmtHjmwe9Krwj
TLSH
T19BD5F25AA3B501ECE4BBD2B8C953450BEBB2B8462330969F47DC4E962F13A715E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_c00818d77d8b63c238869e78b826fecb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-10-25_c00818d77d8b63c238869e78b826fecb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 2.6MB

2026-10-25_c00818d77d8b63c238869e78b826fecb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 4bd9aee0efcf4111ca1ea53289f452aa
SHA256 bd74adcfdb49941c5b87a367dfe02cb7979c9abb2b92179b1f2343459ec3161d
MD5 c00818d77d8b63c238869e78b826fecb
SHA1 bbe8996d1cd1ce1c81c6426015790ebc871242b6
SHA512 25f86e730c900f53eaf7ab07011b029c4625f403c7e9e26c456bc90006e4490cd11633fa6d37dc4d9ad79e400e9c6b13c9ca46572e991195735ca66067957ed9
SSDEEP 49152:5uGdEkwyV9+clmDXZa0jcCGg5kl3n4NivtHE0R3K1w98AeKBqHWwj:59comDgCGgalX4NmtHjmwe9Krwj
TLSH
T19BD5F25AA3B501ECE4BBD2B8C953450BEBB2B8462330969F47DC4E962F13A715E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

864080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyKey BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptOpenAlgorithmProvider

crypt32

CryptUnprotectData CryptStringToBinaryA

winhttp

WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpOpenRequest WinHttpQueryHeaders WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetTimeouts

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusShutdown GdipCloneImage GdipDisposeImage GdiplusStartup GdipAlloc GdipSaveImageToFile GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders GdipFree

gdi32

SelectObject GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCloseKey GetUserNameA RegQueryValueExW

shell32

SHFileOperationW

user32

GetDC ReleaseDC SetProcessDPIAware GetClipboardData CloseClipboard OpenClipboard GetSystemMetrics

kernel32

GetFileType GetConsoleOutputCP GetConsoleMode EnumSystemLocalesW GetFileSizeEx IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetUserDefaultLCID FreeLibrary UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetModuleFileNameW TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileInformationByHandle ReadFile GetTempPathW CloseHandle SetHandleInformation GetLastError CreatePipe PeekNamedPipe WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessW OpenProcess GlobalMemoryStatusEx GetTickCount GetNativeSystemInfo VirtualQueryEx ReadProcessMemory GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW GlobalUnlock GlobalLock LocalFree CopyFileW GetComputerNameA MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW ExitProcess GetCurrentThread GetThreadContext GetModuleHandleA FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime RtlUnwind SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetModuleHandleExW InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread

Name

.text

Size

1008KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_c00818d77d8b63c238869e78b826fecb_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

bcrypt

crypt32

winhttp

iphlpapi

gdiplus

gdi32

advapi32

shell32

user32

kernel32

generic