2026-10-30_8a18fe94bd49fd0ad91a79ddebfb5567_cobalt-strike_glassworm_icedid_njrat_quasar-rat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_8a18fe94bd49fd0ad91a79ddebfb5567_cobalt-strike_glassworm_icedid_njrat_quasar-rat_satacom_stealc
Size 15.8MB
Sample261030-2seq9ssvbz
SHA256 a879e1489ff2ab73938e7be7ac26fe4414a2adbe7b5c732c61c8fa72bdfb3b81
MD5 8a18fe94bd49fd0ad91a79ddebfb5567
SHA1 2f84da22be594fce6339a53fd32a15cf168a3f40
SHA512 29f06925d2d689414dd3423b3e51a272046f5066e68ee4406781be6ea87d936389d418812c1144340bb44daeea4d79fad70d5eaabd55de51b9cb5cb65b1944d0
SSDEEP 196608:9Eze12M8orxCLFnS4kuxjYHuLrUirqN4n6uTkZb:Me12qdC5dk0NoirqN4n6uTkZb
TLSH
T13EF6AE02B6EA40E9C06AD1788A579517FB72BC550331A7CB56F0772A2F77AF04E7D220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-30_8a18fe94bd49fd0ad91a79ddebfb5567_cobalt-strike_glassworm_icedid_njrat_quasar-rat_satacom_stealc

.exe 15.8MB

2026-10-30_8a18fe94bd49fd0ad91a79ddebfb5567_cobalt-strike_glassworm_icedid_njrat_quasar-rat_satacom_stealc

IMPHASH 4c4f296e667848ff863e9f1e20b76388
SHA256 a879e1489ff2ab73938e7be7ac26fe4414a2adbe7b5c732c61c8fa72bdfb3b81
MD5 8a18fe94bd49fd0ad91a79ddebfb5567
SHA1 2f84da22be594fce6339a53fd32a15cf168a3f40
SHA512 29f06925d2d689414dd3423b3e51a272046f5066e68ee4406781be6ea87d936389d418812c1144340bb44daeea4d79fad70d5eaabd55de51b9cb5cb65b1944d0
SSDEEP 196608:9Eze12M8orxCLFnS4kuxjYHuLrUirqN4n6uTkZb:Me12qdC5dk0NoirqN4n6uTkZb
TLSH
T13EF6AE02B6EA40E9C06AD1788A579517FB72BC550331A7CB56F0772A2F77AF04E7D220
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

01:e2:8b:15:06:6a:2a:a9:dc:b1:dd:c9:0b:e9:df:41:e7:fe:2e:de:8d:b2:52:66:d1:96:c4:0d:da:b7:7e:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IP Moskalev Ivan Sergeevich,O=IP Moskalev Ivan Sergeevich,L=Moscow,ST=Moscow,C=RU

Chains

Oct 27, 2026

CN=IP Moskalev Ivan Sergeevich,O=IP Moskalev Ivan Sergeevich,L=Moscow,ST=Moscow,C=RU

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=IP Moskalev Ivan Sergeevich,O=IP Moskalev Ivan Sergeevich,L=Moscow,ST=Moscow,C=RU

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=IP Moskalev Ivan Sergeevich,O=IP Moskalev Ivan Sergeevich,L=Moscow,ST=Moscow,C=RU

Serial Number

50:08:7a:fb:89:15:4a:a8:e2:ac:99:a5

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 10, 2026 - Jul 11, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

9680320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\work\switcher\windows\.build\editions\Classic\x64\Release\CarambaSwitcherClassic.pdb

kernel32

CreateSemaphoreW TlsGetValue TlsFree LoadLibraryW FreeLibrary SetNamedPipeHandleState WaitForMultipleObjects PeekNamedPipe CreateThread CreateProcessW GetExitCodeProcess GlobalAlloc GlobalLock GlobalUnlock ExpandEnvironmentStringsW SetCurrentDirectoryW CopyFileW GetFileType FindNextFileW GlobalMemoryStatus GetTickCount FlushConsoleInputBuffer LoadLibraryA TryEnterCriticalSection GetSystemTimeAsFileTime GetFileSize FindClose GetLongPathNameW FindFirstFileW GetACP SetConsoleCursorPosition WriteConsoleW FreeConsole FillConsoleOutputCharacterW AttachConsole ReadConsoleOutputCharacterA WriteConsoleA GetStdHandle GetConsoleScreenBufferInfo ExitProcess GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP EnumSystemLocalesW IsValidLocale SystemTimeToTzSpecificLocalTime GetConsoleCP GetDriveTypeW SetStdHandle FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent UnhandledExceptionFilter RtlUnwind FlsGetValue RtlUnwindEx InitializeSListHead LCMapStringEx EncodePointer SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared InitOnceComplete InitOnceBeginInitialize GetStringTypeW CopyFile2 CreateFile2 GetLocaleInfoEx LCMapStringW GetSystemInfo ReadDirectoryChangesW GetNumberOfConsoleInputEvents ReadConsoleW ReadConsoleInputW QueueUserWorkItem SetConsoleMode UnregisterWait RegisterWaitForSingleObject SetConsoleCtrlHandler LocalSize LocalAlloc CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus AllocConsole FileTimeToSystemTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetCurrencyFormatW GetNumberFormatW GetUserDefaultLCID CompareStringA CompareStringW GetTempFileNameA GlobalSize AreFileApisANSI HeapCreate GetDiskFreeSpaceW LockFile UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA DeleteFileA HeapCompact UnlockFile SystemTimeToFileTime GetSystemTime CreateFileMappingW MapViewOfFile GetConsoleOutputCP GetConsoleMode GetFullPathNameW lstrlenW GetCurrentDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime CopyFileExW VirtualFree VirtualAlloc GetFullPathNameA HeapDestroy HeapReAlloc HeapSize InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime InitializeCriticalSectionAndSpinCount GetLocalTime WaitNamedPipeW CreateNamedPipeW TransactNamedPipe SetFilePointerEx GetFileSizeEx GetFileTime FindFirstFileExW WerRegisterRuntimeExceptionModule GetVersion AddVectoredExceptionHandler SetUnhandledExceptionFilter UnlockFileEx LockFileEx GetEnvironmentVariableA SleepConditionVariableCS Module32NextW Module32FirstW K32GetModuleFileNameExW MoveFileExW RemoveDirectoryW VirtualQuery VirtualProtect TlsAlloc GetCurrentThread GetExitCodeThread SuspendThread GetThreadContext SetEnvironmentVariableW TlsSetValue GetComputerNameW GetNativeSystemInfo CreateToolhelp32Snapshot IsValidCodePage OpenProcess GetVersionExW TerminateProcess GetCPInfo SetErrorMode EnumResourceNamesW RaiseException SetEvent Sleep CreateEventW ResumeThread GetTempPathW CreateDirectoryW FormatMessageA FindResourceA DeleteCriticalSection InitializeCriticalSection VerifyVersionInfoW VerSetConditionMask GetModuleHandleA LeaveCriticalSection GetThreadLocale EnterCriticalSection SetEndOfFile SetFilePointer MulDiv GetCurrentProcessId CreateMutexExW OpenSemaphoreW QueryPerformanceFrequency WaitForSingleObjectEx MultiByteToWideChar ReleaseMutex WaitForSingleObject ReleaseSemaphore CreateSemaphoreExW CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork GetLocaleInfoW FindResourceW LoadResource ReadFile LockResource SizeofResource SetProcessMitigationPolicy LoadLibraryExW GetSystemDirectoryW SetDefaultDllDirectories CheckRemoteDebuggerPresent IsDebuggerPresent QueryPerformanceCounter CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks GetCurrentProcess FlushFileBuffers OpenMutexW DebugBreak WideCharToMultiByte GetModuleHandleW GetProcessHeap LocalFree GetProcAddress HeapAlloc CloseHandle DeleteFileW OutputDebugStringW GetLastError GetTickCount64 FormatMessageW GetCurrentThreadId GetFileAttributesW CreateFileW CreateMutexW GetEnvironmentVariableW GetUserDefaultUILanguage GetModuleFileNameW OutputDebugStringA GetModuleHandleExW WriteFile GetCommandLineW SetLastError HeapFree GetModuleFileNameA GetStartupInfoW QueryFullProcessImageNameW GetThreadId RtlLookupFunctionEntry SetThreadStackGuarantee IsThreadAFiber FlsSetValue FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW CreateMutexA LoadLibraryExA InitOnceExecuteOnce GetModuleHandleExA GetCurrentProcessorNumber GetProcessTimes InitializeSRWLock DecodePointer ResetEvent InitializeConditionVariable WakeConditionVariable SwitchToThread AcquireSRWLockExclusive ReleaseSRWLockExclusive RemoveVectoredExceptionHandler SleepEx RtlCaptureStackBackTrace WakeAllConditionVariable OpenThread

user32

ModifyMenuW InsertMenuItemW CreatePopupMenu keybd_event HideCaret GetMenuState GetSubMenu SetMenuItemInfoW ValidateRect DestroyMenu InsertMenuW RemoveMenu MsgWaitForMultipleObjects DrawFrameControl MessageBoxW DeregisterShellHookWindow DestroyWindow FindWindowExW SetProcessDpiAwarenessContext PostMessageW AllowSetForegroundWindow DefWindowProcW GetWindowThreadProcessId GetWindowLongPtrW EnumDisplaySettingsW SetMenuInfo SetActiveWindow GetGUIThreadInfo AppendMenuW CreateMenu GetWindowDC BeginPaint EndPaint DestroyCursor UpdateLayeredWindow SetCaretPos CreateCaret DestroyCaret RegisterClipboardFormatW CountClipboardFormats EnumClipboardFormats GetClipboardSequenceNumber LoadStringW MessageBoxA AdjustWindowRectEx GetMessageExtraInfo NotifyWinEvent RegisterClassExW SetClassLongW IsChild CallMsgFilterW IsRectEmpty GetUpdateRect EnumThreadWindows GetClassLongW IsWindowUnicode GetDesktopWindow LoadCursorFromFileA EnumDisplayDevicesW GetKeyboardLayoutNameW ActivateKeyboardLayout GetKeyboardLayoutList OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable SendInput GetDpiForSystem SetWinEventHook GetSystemMetricsForDpi SetTimer RegisterClassW KillTimer EnumDisplayMonitors RegisterWindowMessageW FindWindowW GetForegroundWindow GetKeyboardLayout IsWindow GetDpiForWindow SetWindowLongPtrW RegisterSuspendResumeNotification UnregisterSuspendResumeNotification IsIconic InvalidateRect SetForegroundWindow UpdateWindow SystemParametersInfoW PostQuitMessage GetClientRect SetWindowLongW FlashWindowEx LoadIconW GetMonitorInfoW ShowWindow SendMessageW MonitorFromWindow SetWindowPos GetWindowRect GetWindowLongW TranslateMessage PeekMessageW DispatchMessageW GetMessageW LoadImageW EnumWindows GetSystemMetrics MonitorFromRect IsWindowVisible GetWindow BringWindowToTop LoadBitmapW GetIconInfo EnableMenuItem CreateDialogIndirectParamW IsZoomed DrawMenuBar SetLayeredWindowAttributes GetDialogBaseUnits MoveWindow GetWindowPlacement SetWindowTextW UnregisterClassW GetSystemMenu GetKeyState EnableWindow GetCursorPos ReleaseDC SetCursorPos ReleaseCapture PtInRect GetParent ScrollWindow EnableScrollBar SetCursor SetWindowsHookExW EndDeferWindowPos AnimateWindow SetCapture SetParent SetFocus GetMessageTime UnhookWindowsHookEx IsWindowEnabled GetSysColor MapWindowPoints ClientToScreen VkKeyScanW IsDialogMessageW RedrawWindow GetCapture GetAsyncKeyState BeginDeferWindowPos GetActiveWindow TrackPopupMenu WindowFromPoint GetScrollInfo ChildWindowFromPointEx CallNextHookEx ScreenToClient FillRect GetMenuItemCount GetDC InflateRect GetFocus MapVirtualKeyW CallWindowProcW GetMessagePos GetUpdateRgn GetMenuItemInfoW DeferWindowPos SetScrollInfo GetDlgItem CreateDialogParamW GetProcessDefaultLayout LoadCursorW DrawIconEx CopyRect OffsetRect DrawTextW DrawFocusRect CreateIconIndirect GetCaretBlinkTime GetDoubleClickTime DestroyIcon GetWindowTextW SetRect GetClassNameW ChangeDisplaySettingsExW MessageBeep GetWindowTextLengthW GetMenuBarInfo SetMenu RegisterShellHookWindow CreateWindowExW SetRectEmpty DrawStateW UnhookWinEvent PostThreadMessageW MonitorFromPoint CheckMenuRadioItem GetMenuItemID CheckMenuItem GetUserObjectInformationW GetProcessWindowStation SetWindowRgn SendMessageTimeoutW MsgWaitForMultipleObjectsEx

shell32

ord727 SHGetFileInfoW ShellExecuteW CommandLineToArgvW SHGetKnownFolderPath SHFileOperationW SHGetPathFromIDListW ExtractIconW ExtractIconExW DragQueryFileW DragQueryPoint DragFinish SHGetSpecialFolderPathW SHBrowseForFolderW Shell_NotifyIconW ShellExecuteExW SHGetFolderPathW

comctl32

ImageList_Add ImageList_GetIconSize ImageList_DrawEx ord17 ImageList_Replace ImageList_SetBkColor ImageList_Create ImageList_GetImageInfo ImageList_Draw ImageList_Destroy

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

wininet

InternetSetOptionW InternetCloseHandle InternetReadFileExW InternetOpenUrlA InternetCrackUrlA InternetSetStatusCallbackW InternetQueryOptionA HttpQueryInfoA InternetOpenW

shlwapi

PathMatchSpecW SHAutoComplete StrStrIW

crypt32

CryptHashCertificate2 CryptStringToBinaryA CryptUnprotectData CryptProtectData

uxtheme

SetWindowTheme IsThemePartDefined IsThemeActive IsAppThemed GetThemeMargins DrawThemeParentBackground GetThemePartSize IsThemeBackgroundPartiallyTransparent CloseThemeData GetThemeColor DrawThemeBackground GetThemeBackgroundContentRect OpenThemeData

ole32

OleSetContainedObject OleRun OleLockRunning CoCreateGuid CreateStreamOnHGlobal CoTaskMemAlloc CoCreateInstance OleInitialize OleUninitialize CoTaskMemFree

oleaut32

SafeArrayLock SafeArrayGetVartype VarBstrFromCy SysStringLen SafeArrayPtrOfIndex SafeArrayDestroy VariantInit SysFreeString SysAllocString SafeArrayCreate VariantClear SafeArrayUnlock SysAllocStringLen

gdi32

SelectClipRgn Rectangle SetBkMode GetRegionData GetGraphicsMode PolyPolygon SetTextColor DeleteDC ExtCreateRegion GetPixel SetPolyFillMode SetViewportExtEx Polygon Polyline CreatePolygonRgn ExtFloodFill SetWindowExtEx GetClipBox GetStockObject SetWindowOrgEx SetLayout StretchBlt GetLayout SetPixel CreateCompatibleDC GetViewportExtEx MaskBlt Ellipse Arc GetWindowExtEx Pie CreateCompatibleBitmap BitBlt CreateBitmap CreateBitmapIndirect GetOutlineTextMetricsW MoveToEx LineTo GetBkColor CreateSolidBrush OffsetRgn CreatePatternBrush CreateHatchBrush GetRgnBox CombineRgn PtInRegion SetStretchBltMode LPtoDP SetMapMode ExtSelectClipRgn SetROP2 CreateFontIndirectW GetObjectType RoundRect ExtTextOutW DPtoLP DeleteObject GetObjectW ExcludeClipRect CreateRectRgn RectInRegion EqualRgn GetDIBits CreateDIBitmap GetDIBColorTable CreateDIBSection GetCharABCWidthsW GetTextExtentPoint32W GetTextExtentExPointW ExtCreatePen CreatePen CreateDCW SetBrushOrgEx GetTextMetricsW GetDeviceCaps GdiFlush SelectObject SetBkColor StretchDIBits AddFontMemResourceEx EndPage StartDocW EndDoc StartPage GetGlyphIndicesW GetObjectA CreateFontW EnumFontFamiliesExW GetFontUnicodeRanges RestoreDC SetViewportOrgEx SaveDC

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

wintrust

CryptCATAdminReleaseContext WTHelperProvDataFromStateData CryptCATCatalogInfoFromContext CryptCATAdminEnumCatalogFromHash CryptCATAdminAcquireContext2 CryptCATAdminReleaseCatalogContext WTHelperGetProvSignerFromChain CryptCATAdminCalcHashFromFileHandle2 WinVerifyTrust

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlPcToFileHeader RtlVirtualUnwind RtlNtStatusToDosError NtReadFile RtlCaptureContext

dwmapi

DwmSetWindowAttribute

msimg32

AlphaBlend GradientFill

gdiplus

GdipGetFontSize GdipAddPathLine GdipMultiplyLineTransform GdipSetPathGradientPresetBlend GdipGetImageHeight GdipSetImageAttributesColorMatrix GdipSetCompositingQuality GdipAddPathRectangleI GdipAddPathArcI GdipSaveGraphics GdipDrawImageRectRect GdipSetLineWrapMode GdipSetPathGradientTransform GdipSetClipRect GdipSetPathGradientCenterPoint GdipFillRectanglesI GdipCloneImage GdipSetPenStartCap GdipBitmapUnlockBits GdipDeleteBrush GdipIsVisiblePathPoint GdipRotateMatrix GdipScaleMatrix GdipAlloc GdipCreateMatrix2 GdipAddPathBezier GdipDisposeImageAttributes GdipDeletePath GdipCreatePathGradientFromPath GdipCreateMatrix GdipDisposeImage GdipSetSmoothingMode GdipEndContainer GdipGetWorldTransform GdipCreateLineBrush GdipCreatePath GdipSetPenMiterLimit GdipSetLinePresetBlend GdipSetInterpolationMode GdipSetPathGradientWrapMode GdipCreateSolidFill GdipResetPath GdipFillPie GdipShearMatrix GdipFillPath GdipGetPathWorldBounds GdipGetLineSpacing GdipMultiplyWorldTransform GdipGraphicsClear GdipGetCellAscent GdipCreateFromHWND GdipDrawLine GdipAddPathLineI GdipDrawRectangle GdipSetPixelOffsetMode GdipFillRectangle GdipAddPathEllipse GdipSetPageUnit GdipSetClipRectI GdipClosePathFigure GdipTransformPoints GdipGetSmoothingMode GdipCreateImageAttributes GdipFree GdipDrawPath GdipTranslateMatrix GdipBitmapLockBits GdipSetPenLineJoin GdipGetClipBoundsI GdipCreateFromHDC GdipFillEllipse GdipSetPenEndCap GdipBeginContainer2 GdipCreateTexture GdipGetMatrixElements GdipSetTextRenderingHint GdipDrawEllipse GdipRestoreGraphics GdipCloneBrush GdipSetPenDashOffset GdipCreateHBITMAPFromBitmap GdipDrawPie GdipFillRectangleI GdipAddPathArc GdipCreatePen2 GdipDeleteGraphics GdipClonePath GdipDrawArc GdipStartPathFigure GdipGetImageWidth GdipTranslateWorldTransform GdipDeletePen GdipCreateBitmapFromScan0 GdipSetPathFillMode GdipCreatePen1 GdipDeleteMatrix GdipGetEmHeight GdipCreateFontFromLogfontA GdipGetFamily GdipDeleteFontFamily GdiplusShutdown GdipDeleteFont GdipSetPenDashStyle GdipCreateFontFromDC GdiplusStartup GdipDrawImageI GdipCreateBitmapFromGraphics GdipDrawDriverString GdipSetPenDashArray GdipGetImageGraphicsContext

urlmon

FindMimeFromData

oleacc

LresultFromObject AccessibleObjectFromWindow

imm32

ImmIsIME ImmNotifyIME ImmAssociateContextEx ImmSetCandidateWindow ImmGetCompositionStringW ImmReleaseContext ImmGetContext

usp10

ScriptItemize ScriptBreak ScriptApplyDigitSubstitution ScriptShape ScriptPlace ScriptFreeCache

comdlg32

CommDlgExtendedError GetSaveFileNameW GetOpenFileNameW PrintDlgW

winspool.drv

ord203

Name

.text

Size

9.8MB

Virtual Size

9.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

317KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

343KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_8a18fe94bd49fd0ad91a79ddebfb5567_cobalt-strike_glassworm_icedid_njrat_quasar-rat_satacom_stealc

kernel32

user32

shell32

comctl32

rpcrt4

wininet

shlwapi

crypt32

uxtheme

ole32

oleaut32

gdi32

api-ms-win-core-synch-l1-2-0

wintrust

bcryptprimitives

ntdll

dwmapi

msimg32

gdiplus

urlmon

oleacc

imm32

usp10

comdlg32

winspool.drv

generic