2026-10-27_ebd3ad7fed8f4e78879468933c0c3a77_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_ebd3ad7fed8f4e78879468933c0c3a77_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.3MB
Sample261027-24a78axthy
SHA256 c10ccdf436d5fd9c8ce7a83d0abe2990e73ca13fe9cc75271e8e77f65c463174
MD5 ebd3ad7fed8f4e78879468933c0c3a77
SHA1 e619f85cc1f75a00c4b28be572cbd7be196a6036
SHA512 725593c3556b9aa6a0f49d99a925f61dae492309ae8d9be3f4de1483315e4da7892fe5506135e4d22469c7c3a1fd862887a5419d4d7a8e91b0229d75b283ff41
SSDEEP 49152:HSfWpK+qbYc0YQolVxc9wN/1iLp/KDttgHfGSOqg0:yOAv6Kfl1iNKf0
TLSH
T199265C1632A800E8D09AD1788E17D636D6763C4A133196EF16D0BF5B3F736E1AE7E610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-27_ebd3ad7fed8f4e78879468933c0c3a77_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-27_ebd3ad7fed8f4e78879468933c0c3a77_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.3MB

2026-10-27_ebd3ad7fed8f4e78879468933c0c3a77_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH d5516e383aed61a58be3e124967202e4
SHA256 c10ccdf436d5fd9c8ce7a83d0abe2990e73ca13fe9cc75271e8e77f65c463174
MD5 ebd3ad7fed8f4e78879468933c0c3a77
SHA1 e619f85cc1f75a00c4b28be572cbd7be196a6036
SHA512 725593c3556b9aa6a0f49d99a925f61dae492309ae8d9be3f4de1483315e4da7892fe5506135e4d22469c7c3a1fd862887a5419d4d7a8e91b0229d75b283ff41
SSDEEP 49152:HSfWpK+qbYc0YQolVxc9wN/1iLp/KDttgHfGSOqg0:yOAv6Kfl1iNKf0
TLSH
T199265C1632A800E8D09AD1788E17D636D6763C4A133196EF16D0BF5B3F736E1AE7E610
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4493312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\github\UXG-MISC\install\Neoma\utils\AMDInstallUEP\x64\Release\AMDInstallUEP.pdb

userenv

GetUserProfileDirectoryW

ncrypt

BCryptSignHash BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptImportKey BCryptExportKey BCryptDecrypt BCryptEncrypt BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider NCryptFreeObject BCryptVerifySignature NCryptOpenStorageProvider NCryptImportKey BCryptImportKeyPair

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpSetStatusCallback WinHttpWriteData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReadData WinHttpQueryHeaders WinHttpConnect WinHttpReceiveResponse

kernel32

OpenThread InitializeConditionVariable InitializeSRWLock WriteConsoleW SetEndOfFile SetStdHandle DeleteFileW SetWaitableTimer SetLastError EnterCriticalSection CreateWaitableTimerW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetLocaleInfoW WaitForSingleObject PostQueuedCompletionStatus CreateEventW Sleep FormatMessageW RtlCaptureStackBackTrace SetEvent TerminateThread CloseHandle QueueUserAPC LocalFree LoadLibraryA WideCharToMultiByte SleepEx GetSystemTime FormatMessageA CreateIoCompletionPort MultiByteToWideChar FindClose FindFirstFileW FindNextFileW GetCurrentProcess GetModuleFileNameW GetSystemInfo GetModuleHandleA VerSetConditionMask VerifyVersionInfoW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreatePipe GetExitCodeProcess GetTimeZoneInformation HeapQueryInformation HeapSize ReadConsoleW VerifyVersionInfoA GetQueuedCompletionStatusEx SetFileCompletionNotificationModes CreateFileA ConnectNamedPipe PeekNamedPipe CancelIo CreateNamedPipeA DeleteCriticalSection GetLastError EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapReAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle ExitProcess CreateProcessW DuplicateHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetLocaleInfoEx CreateFileW FindFirstFileExW GetFileAttributesW GetFileAttributesExW RtlUnwind GetTempPathW AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx RtlPcToFileHeader RaiseException QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo InitOnceExecuteOnce GetSystemTimeAsFileTime

wininet

InternetCloseHandle InternetReadFile InternetWriteFile InternetSetOptionA InternetOpenA HttpAddRequestHeadersA HttpSendRequestExA HttpEndRequestA HttpQueryInfoA InternetConnectA HttpOpenRequestA

user32

wsprintfW

advapi32

OpenProcessToken CryptImportKey CryptDestroyKey CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey RegOpenKeyExW RegGetValueW

shell32

SHGetKnownFolderPath

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

ws2_32

shutdown WSACleanup ntohs listen getsockname WSAIoctl recv htons inet_ntop inet_pton socket bind WSAGetLastError setsockopt ioctlsocket freeaddrinfo getsockopt WSARecv connect WSAStartup getaddrinfo WSASocketW WSASetLastError select WSASend closesocket send

secur32

InitializeSecurityContextA ApplyControlToken DecryptMessage AcquireCredentialsHandleA DeleteSecurityContext AcceptSecurityContext QueryContextAttributesA FreeContextBuffer EncryptMessage

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFreeCertificateContext CryptStringToBinaryA CryptQueryObject CertAddCertificateContextToStore CertSetCertificateContextProperty CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CertVerifyCertificateChainPolicy

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

798KB

Virtual Size

798KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

154KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

551KB

Virtual Size

551KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_ebd3ad7fed8f4e78879468933c0c3a77_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

userenv

ncrypt

version

winhttp

kernel32

wininet

user32

advapi32

shell32

ole32

oleaut32

ws2_32

secur32

crypt32

generic