2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 6.4MB
Sample261029-2htgnsft7v
SHA256 e85ece7f3959d62df7a5d3a59363ea3a75e177d8dbdbd985fcf02436cb0d27ba
MD5 9dbb3d1c91d3d79fabfbcb744cf73de7
SHA1 085a750f93af92821a4b485accd5859d58e1e215
SHA512 17f5c75e4ea88bccec1e440341d0da8b0ead752f9ea20a5772989d23d577302419815175ceda6b3e00713dfa037c61d6a072f6e186b6cd4c6c62c29d69de29f5
SSDEEP 98304:Qf+5INhrKmsxFM6dsepXd+3Ps1PvQb6Y+k:COmsxFM6aexd+/QP9Y+k
TLSH
T1CC667C5663F802DCE0B7C678C6264A13D6B2BC165771D7CF1264956A0F33BE18E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 6.4MB

2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 8610526ed2420687e5292a18da445809
SHA256 e85ece7f3959d62df7a5d3a59363ea3a75e177d8dbdbd985fcf02436cb0d27ba
MD5 9dbb3d1c91d3d79fabfbcb744cf73de7
SHA1 085a750f93af92821a4b485accd5859d58e1e215
SHA512 17f5c75e4ea88bccec1e440341d0da8b0ead752f9ea20a5772989d23d577302419815175ceda6b3e00713dfa037c61d6a072f6e186b6cd4c6c62c29d69de29f5
SSDEEP 98304:Qf+5INhrKmsxFM6dsepXd+3Ps1PvQb6Y+k:COmsxFM6aexd+/QP9Y+k
TLSH
T1CC667C5663F802DCE0B7C678C6264A13D6B2BC165771D7CF1264956A0F33BE18E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2490604

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSEnumerateSessionsW

powrprof

PowerWriteDCValueIndex PowerReadDCValueIndex PowerSettingUnregisterNotification PowerUnregisterFromEffectivePowerModeNotifications PowerWriteACValueIndex PowerReadFriendlyName PowerEnumerate PowerReadValueMax PowerReadValueMin PowerGetActiveScheme PowerReadACValueIndex PowerSetActiveScheme

kernel32

SetThreadAffinityMask TryEnterCriticalSection FindFirstFileW SetHandleInformation EnterCriticalSection FindNextFileW GetModuleHandleExW TerminateProcess RemoveDirectoryW SetThreadPriority LeaveCriticalSection CreatePipe InitializeCriticalSection SetFilePointer GetEnvironmentVariableW SetEndOfFile PeekNamedPipe FindClose GetLocaleInfoW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA GetFileInformationByHandle FormatMessageW GetFileAttributesExW GetCurrentThread TerminateThread QueryPerformanceFrequency DeleteFileW GetCurrentDirectoryW ReplaceFileW ExitProcess GetModuleHandleW CopyFileW QueryPerformanceCounter MoveFileW GetDriveTypeW IsDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers OpenEventW OpenMutexW SetLastError FileTimeToSystemTime LoadLibraryExW VerifyVersionInfoW VerSetConditionMask GetFullPathNameW SetEnvironmentVariableW SetFilePointerEx GetFileSizeEx LCMapStringW UnregisterWaitEx WriteConsoleInputW SetConsoleCursorPosition GetConsoleScreenBufferInfo WriteConsoleW ReadConsoleInputW GetNumberOfConsoleInputEvents GetNamedPipeHandleStateA CreateNamedPipeW WriteFile CancelIo ReadFile lstrcpyW CreateThread WaitForSingleObjectEx lstrcatW SetEvent CreateEventW lstrlenW OutputDebugStringW CreateFileW DeviceIoControl DecodePointer DeleteCriticalSection GetLastError RaiseException GetTempPathW GetSystemDirectoryA GetSystemWindowsDirectoryW GetModuleFileNameW MultiByteToWideChar FlsGetValue CloseHandle GetExitCodeProcess CreateToolhelp32Snapshot GetProcessId CreateDirectoryW InitializeCriticalSectionEx GetProcAddress CancelSynchronousIo SetNamedPipeHandleState CreateFileA DebugBreak FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcess IsWow64Process2 GetLongPathNameW ReadDirectoryChangesW LoadLibraryExA GetStartupInfoW FindFirstFileExW QueueUserWorkItem PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetErrorMode ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode RtlVirtualUnwind SetConsoleCtrlHandler UnregisterWait RegisterWaitForSingleObject SwitchToThread CancelIoEx ReleaseMutex CreateMutexW GetSystemFirmwareTable GetLogicalDriveStringsW Sleep CreateProcessW OpenProcess ProcessIdToSessionId Process32NextW LoadLibraryW GetSystemDirectoryW FreeLibrary LocalAlloc LocalFree CreateSemaphoreA ReleaseSemaphore SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable AreFileApisANSI SleepConditionVariableSRW EncodePointer LCMapStringEx GetSystemTime SystemTimeToFileTime RtlUnwind FlsAlloc DuplicateHandle HeapSize GetProcessHeap GetOEMCP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CompareStringW HeapAlloc HeapFree GetCommandLineW GetCommandLineA GetConsoleOutputCP SetStdHandle SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionAndSpinCount GetCPInfo GetStringTypeW FlsFree FlsSetValue WTSGetActiveConsoleSessionId Process32FirstW GetSystemPowerStatus GetCurrentProcessId GetTimeZoneInformation ConnectNamedPipe GetOverlappedResult DisconnectNamedPipe WaitForSingleObject WaitForMultipleObjects GetEnvironmentVariableA GetSystemTimeAsFileTime ResetEvent CreateEventA WideCharToMultiByte InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetStdHandle GetFileType LoadLibraryA FormatMessageA GetACP ConvertFiberToThread ConvertThreadToFiberEx

user32

DefWindowProcW PostMessageW DestroyWindow UnregisterSuspendResumeNotification RegisterClassExW EnumWindows TranslateMessage GetWindowTextW AttachThreadInput GetWindowThreadProcessId wsprintfW UnregisterClassW RegisterPowerSettingNotification RegisterSuspendResumeNotification CreateWindowExW SendMessageTimeoutW GetSystemMetrics MapVirtualKeyW DispatchMessageA GetMessageA MessageBoxW GetUserObjectInformationW GetProcessWindowStation UnregisterPowerSettingNotification

advapi32

CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegCloseKey RegOpenKeyExW RegQueryValueExW DeleteService QueryServiceStatus ControlService CreateServiceW OpenServiceW OpenSCManagerW CloseServiceHandle CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

SHGetKnownFolderPath SHGetSpecialFolderPathW

ole32

CoUninitialize StringFromCLSID CoSetProxyBlanket CoTaskMemFree CoTaskMemAlloc CoInitializeEx OleUninitialize CoCreateInstance OleInitialize CoCreateFreeThreadedMarshaler CoInitializeSecurity

oleaut32

SafeArrayCreate SafeArrayAccessData VariantInit SafeArrayGetElement SafeArrayGetUBound SafeArrayUnaccessData VariantClear SysAllocString SysFreeString GetErrorInfo SafeArrayGetLBound SetErrorInfo SafeArrayPutElement SysStringLen

shlwapi

PathRemoveFileSpecW PathAppendW

hid

HidD_GetPreparsedData HidD_GetInputReport HidP_GetButtonCaps HidD_GetProductString HidD_GetManufacturerString HidP_GetCaps HidD_GetAttributes HidD_FreePreparsedData HidD_SetFeature HidD_GetFeature HidD_GetHidGuid

cfgmgr32

CM_Get_Child CM_Get_Sibling

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDevicePropertyW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

rpcrt4

UuidFromStringA

wininet

InternetOpenW InternetCrackUrlW InternetWriteFile HttpSendRequestExW InternetCloseHandle InternetConnectW InternetSetOptionW FtpOpenFileW HttpOpenRequestW HttpEndRequestW InternetSetFilePointer HttpQueryInfoW InternetReadFile

ws2_32

shutdown WSASetLastError getservbyname getservbyport gethostbyaddr WSACleanup gethostbyname __WSAFDIsSet bind closesocket select listen getaddrinfo WSAStartup WSAIoctl send socket ntohs connect inet_ntoa recv getsockopt htonl htons freeaddrinfo sendto ioctlsocket setsockopt WSAGetLastError WSASocketW WSARecv WSARecvFrom inet_addr accept

winmm

timeGetTime timeKillEvent timeBeginPeriod

bcrypt

BCryptGenRandom

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertCloseStore CertGetCertificateContextProperty

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

612KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=259, version=30795,

count=209, id=261, version=30795,

count=6, id=253, version=28518,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=108, id=261, version=30034,

count=35, id=260, version=31933,

count=1, id=261, version=32215,

count=6, id=260, version=32215,

count=783, id=260, version=31935,

count=31, productName=Unmarked objects (old),

count=1, id=260, version=32825,

count=1, id=261, version=32534,

count=38, id=260, version=30795,

count=2, id=262, version=30795,

count=1, id=263, version=30795,

count=45, id=257, version=30795,

count=533, id=1, productName=Unmarked objects,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=67, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,