2026-10-26_c26cac2d848c6c6f3af037c15970f5bf_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_c26cac2d848c6c6f3af037c15970f5bf_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 8.7MB
Sample261027-jdajwsstcs
SHA256 83176e0891137198d56555270bb45603007e2f14eb4540a38497210bb055a2c5
MD5 c26cac2d848c6c6f3af037c15970f5bf
SHA1 cf476125e9d2d04fa8d2f72760867f4e3db24753
SHA512 a6238e0654b84c58a210deb0dbcb5c535630a400995adfe434076aa9d0faeaa437397fde390b4f0f71703962b167b45dd52b3d48377b66a3c83b3eb6b364441d
SSDEEP 98304:0/KLXpMLGIuKkkx/JOq13wNtfOguVNczeT007kxUarDBRqpF4WA:0YpMLGakkx/Yq9wNtfnK490761hM4
TLSH
T1BB96BF6BA7E840ECD8B7C17CC9564503E7B2B81547319BDF0AA4566A0F73AE05E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_c26cac2d848c6c6f3af037c15970f5bf_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-26_c26cac2d848c6c6f3af037c15970f5bf_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 8.7MB

2026-10-26_c26cac2d848c6c6f3af037c15970f5bf_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 87f75f79595408173dda87dd72160e82
SHA256 83176e0891137198d56555270bb45603007e2f14eb4540a38497210bb055a2c5
MD5 c26cac2d848c6c6f3af037c15970f5bf
SHA1 cf476125e9d2d04fa8d2f72760867f4e3db24753
SHA512 a6238e0654b84c58a210deb0dbcb5c535630a400995adfe434076aa9d0faeaa437397fde390b4f0f71703962b167b45dd52b3d48377b66a3c83b3eb6b364441d
SSDEEP 98304:0/KLXpMLGIuKkkx/JOq13wNtfOguVNczeT007kxUarDBRqpF4WA:0YpMLGakkx/Yq9wNtfnK490761hM4
TLSH
T1BB96BF6BA7E840ECD8B7C17CC9564503E7B2B81547319BDF0AA4566A0F73AE05E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4381208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\JENKINS\workspace\A_MBAM3_UPDATEREXE\bin\x64\Release\mbupdatr.pdb

crypt32

CertGetCertificateChain CertGetIssuerCertificateFromStore CertCreateCertificateContext CertCompareCertificateName CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertFreeCertificateChain CryptDecodeObject CryptDecodeObjectEx CryptMsgGetParam CertGetNameStringW CertFindCertificateInStore CryptQueryObject CryptMsgClose CertFreeCertificateContext CertDuplicateCertificateContext CertAddEncodedCertificateToStore CertOpenStore CryptStringToBinaryA CertCloseStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertOpenSystemStoreW CryptProtectData CryptUnprotectData

iphlpapi

GetAdaptersInfo

kernel32

GetFileInformationByHandleEx CreateWaitableTimerW SetWaitableTimer DuplicateHandle GetSystemFirmwareTable DeviceIoControl OpenThread SetThreadPriority SetFileInformationByHandle FindNextFileW FindClose GlobalAlloc GlobalFree GetLocalTime GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetTimeZoneInformation SetFileTime lstrcmpA GetFileSize GetStdHandle FindFirstFileW GetFileAttributesW GetModuleHandleA GetFileAttributesExW OutputDebugStringW QueryPerformanceFrequency QueryPerformanceCounter ExpandEnvironmentStringsW GetDriveTypeW GetLogicalDrives GetSystemWindowsDirectoryW GetCurrentDirectoryW GetVersionExA GetHandleInformation CreateIoCompletionPort GetQueuedCompletionStatusEx InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitializeCriticalSection InitOnceExecuteOnce SetFileCompletionNotificationModes GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount ResetEvent ReleaseMutex CreateMutexW GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetEnvironmentVariableW VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA LoadLibraryA FormatMessageA ReleaseSemaphore CreateSemaphoreA GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFullPathNameW GetFileInformationByHandle VirtualQueryEx CopyFileW GetCurrentThread QueryDosDeviceW GetLogicalDriveStringsW Module32FirstW SetLastError GetNativeSystemInfo IsWow64Process GetSystemInfo GetFileSizeEx VerSetConditionMask GetVersionExW LockResource LoadResource SizeofResource FindResourceW GetLongPathNameW MultiByteToWideChar WideCharToMultiByte ProcessIdToSessionId GetCurrentProcess MoveFileW CreateThread GetProcessId GetProcessHeap FormatMessageW HeapSize HeapReAlloc HeapFree HeapAlloc GetCurrentThreadId LocalAlloc GetTickCount CallNamedPipeW DebugBreak CreateRemoteThread OpenEventW GetNamedPipeServerProcessId WriteFile WaitForMultipleObjects CreateEventW FreeLibrary SetEvent LoadLibraryW GetSystemDirectoryW GetProcAddress MoveFileExW GetExitCodeProcess ResumeThread CreateProcessW OpenFileMappingW SwitchToThread UnmapViewOfFile Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcessTimes TerminateProcess OpenProcess SetEndOfFile SetFilePointer MapViewOfFile CreateFileMappingW CreateDirectoryW RemoveDirectoryW CreateNamedPipeW GetCurrentProcessId GetTickCount64 GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW PeekNamedPipe ReadFile GetModuleFileNameW WaitForSingleObject DeleteFileW CreateFileW DecodePointer GetModuleHandleW LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx LocalFree DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList GetLastError CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA SetConsoleCtrlHandler GetConsoleOutputCP RtlUnwind SetFilePointerEx SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx RaiseException IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable InitializeSListHead GetCPInfo LCMapStringEx EncodePointer GetStringTypeW FindFirstFileExW GetLocaleInfoEx SetFileAttributesW VerifyVersionInfoW FlushFileBuffers Sleep DeleteCriticalSection CloseHandle

user32

CloseDesktop OpenInputDesktop MessageBoxW wsprintfW GetProcessWindowStation GetUserObjectInformationW CharUpperW CloseWindowStation OpenWindowStationW SetProcessWindowStation

advapi32

CryptAcquireContextW OpenServiceW ControlService CloseServiceHandle RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegCloseKey ChangeServiceConfig2A RegCreateKeyW DeleteService QueryServiceStatusEx StartServiceW QueryServiceStatus CreateServiceW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus RegQueryValueExW RegEnumKeyExW RegOpenKeyW RegSetValueExW ChangeServiceConfigA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges DuplicateTokenEx CreateProcessAsUserW ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptAcquireContextA RegSaveKeyW RegRestoreKeyW RegQueryInfoKeyW RegLoadAppKeyW RegEnumValueW RegEnumKeyW TreeSetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo SetNamedSecurityInfoW DeleteAce GetExplicitEntriesFromAclW CreateWellKnownSid LookupAccountNameW InitializeSid AllocateLocallyUniqueId GetSidSubAuthority GetSidSubAuthorityCount RegSetKeyValueW RegGetValueW RegDeleteValueW RegUnLoadKeyW RegLoadKeyW IsTextUnicode SetEntriesInAclW SetServiceObjectSecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor AreAllAccessesGranted MapGenericMask GetNamedSecurityInfoW ConvertStringSidToSidW ConvertSidToStringSidW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptReleaseContext RevertToSelf IsWellKnownSid QueryServiceConfigW QueryServiceConfig2W ChangeServiceConfig2W ChangeServiceConfigW ImpersonateLoggedOnUser FreeSid CheckTokenMembership AllocateAndInitializeSid GetTokenInformation OpenThreadToken OpenSCManagerW

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree CoCreateInstance CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitializeEx CoGetClassObject PropVariantClear

oleaut32

SafeArrayGetLBound SafeArrayDestroy SafeArrayCreate VariantTimeToSystemTime SafeArrayLock SysAllocStringLen SystemTimeToVariantTime SafeArrayGetVartype VariantInit SysStringLen SysAllocString SysFreeString VariantClear SafeArrayGetUBound SafeArrayUnlock

mpr

WNetGetConnectionW

shlwapi

StrDupW

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winhttp

WinHttpSetCredentials WinHttpOpen WinHttpReceiveResponse WinHttpReadData WinHttpSetOption WinHttpCloseHandle WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpQueryHeaders WinHttpQueryDataAvailable

netapi32

NetApiBufferFree NetWkstaGetInfo

psapi

GetProcessImageFileNameW

sfc

SfcIsFileProtected

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

setupapi

SetupFindNextLine SetupGetIntField SetupGetStringFieldW SetupFindFirstLineW SetupCloseInfFile SetupOpenInfFileW SetupGetMultiSzFieldW SetupGetLineTextW

authz

AuthzInitializeContextFromSid AuthzAccessCheck AuthzFreeContext AuthzFreeResourceManager AuthzInitializeResourceManager

wintrust

CryptCATAdminReleaseContext CryptCATAdminAcquireContext CryptCATAdminAddCatalog CryptCATAdminRemoveCatalog WinVerifyTrust CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext

bcrypt

BCryptImportKeyPair BCryptGetProperty BCryptVerifySignature BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCreateHash BCryptHashData BCryptDestroyHash

ws2_32

getservbyname freeaddrinfo getaddrinfo ntohl inet_addr WSASendTo WSASend bind gethostbyname socket shutdown setsockopt ntohs htons WSACleanup getservbyport gethostbyaddr inet_ntoa WSASetLastError accept htonl WSAStartup WSAGetLastError sendto select WSAIoctl WSARecv send recvfrom recv listen getsockopt getsockname getpeername ioctlsocket closesocket WSASocketA WSARecvFrom connect

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

110KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

243KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

922KB

Virtual Size

922KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

824KB

Virtual Size

828KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_c26cac2d848c6c6f3af037c15970f5bf_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

crypt32

iphlpapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

shlwapi

rpcrt4

wtsapi32

userenv

winhttp

netapi32

psapi

sfc

version

setupapi

authz

wintrust

bcrypt

ws2_32

generic