2026-11-01_fe79f416d8f4ad6fe128ffc16bda5697_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_fe79f416d8f4ad6fe128ffc16bda5697_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 4.8MB
Sample261102-bvp2xaztcs
SHA256 da218c4a155e7f339988fdbdf1bcd4c51b1925b28d500bb81e90d0119efbde1d
MD5 fe79f416d8f4ad6fe128ffc16bda5697
SHA1 f3aab1d53381f576a8fc0f9f57aa47399e9b8d86
SHA512 4ea3fd756919eb096c5825aff57f385b055a14525bccc8bda68d34be7e8ea664a8ab8d0a7441c1d59b8d27738bb7bebb05d09a4096ec24d60117c763e847dd80
SSDEEP 49152:FDQJE+1A++B+O93+xG96G9Cb3NmGUdO7m9buq7M9c0zVG/mr4/YaX2:2qVruQ9Cb3N3noo6CVCdQam
TLSH
T17036E156A3A410FAD1B7C179C9538613E7B2BC590320DBDF03A09A692F337D56E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_fe79f416d8f4ad6fe128ffc16bda5697_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-11-01_fe79f416d8f4ad6fe128ffc16bda5697_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 4.8MB

2026-11-01_fe79f416d8f4ad6fe128ffc16bda5697_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 8dac155865a010dc953bf586eeb8bec7
SHA256 da218c4a155e7f339988fdbdf1bcd4c51b1925b28d500bb81e90d0119efbde1d
MD5 fe79f416d8f4ad6fe128ffc16bda5697
SHA1 f3aab1d53381f576a8fc0f9f57aa47399e9b8d86
SHA512 4ea3fd756919eb096c5825aff57f385b055a14525bccc8bda68d34be7e8ea664a8ab8d0a7441c1d59b8d27738bb7bebb05d09a4096ec24d60117c763e847dd80
SSDEEP 49152:FDQJE+1A++B+O93+xG96G9Cb3NmGUdO7m9buq7M9c0zVG/mr4/YaX2:2qVruQ9Cb3N3noo6CVCdQam
TLSH
T17036E156A3A410FAD1B7C179C9538613E7B2BC590320DBDF03A09A692F337D56E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

487344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\C\مجلد جديد (2)\مجلد جديد (2)1\مجلد جديد (2)\Release\مجلد جديد\vipLoader3+xpl-auto-bloker\vipLoader3+xpl-auto\vipLoader3+CMDnew\mw3-auto\mw3-auto\Loader 2\Output\SysUtil.pdb

kernel32

Process32First Process32Next HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap WinExec LocalFree SetLastError GetConsoleWindow EnterCriticalSection LeaveCriticalSection SleepEx VerSetConditionMask QueryPerformanceFrequency VerifyVersionInfoA QueryPerformanceCounter MoveFileExA WaitForSingleObjectEx MultiByteToWideChar GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects GetFileSizeEx GetConsoleMode CreateToolhelp32Snapshot SetConsoleTitleA SetConsoleTextAttribute SetConsoleScreenBufferInfoEx GetConsoleScreenBufferInfoEx SetConsoleOutputCP SetConsoleCP FormatMessageA CreateDirectoryW FindFirstFileExW CopyFileW LoadLibraryW LoadLibraryA LoadLibraryExA GetProcAddress GetModuleHandleA GetModuleFileNameW GetModuleFileNameA FreeLibrary VirtualFree VirtualProtect VirtualAlloc GetWindowsDirectoryW GetSystemDirectoryA GetTickCount GetSystemTimeAsFileTime OpenProcess CreateProcessW CreateThread TerminateProcess GetCurrentProcess Sleep CreateMutexA WaitForSingleObject GetLastError Beep IsDebuggerPresent GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetCurrentProcessId SetConsoleMode WriteFile SetFileAttributesA ReadFile FindNextFileW FindFirstFileW FindClose DeleteFileW GetLocaleInfoEx CreateFileA GetCommandLineW GetStdHandle DeviceIoControl CloseHandle WideCharToMultiByte CreateFileW GetCurrentThreadId InitializeSListHead OutputDebugStringW

user32

EnumWindows GetWindow SetWindowsHookExA UnhookWindowsHookEx MessageBoxA GetWindowTextW SetForegroundWindow IsWindowVisible ShowWindow PostThreadMessageA GetWindowThreadProcessId

advapi32

CryptCreateHash CryptReleaseContext CryptGenRandom RegCloseKey RegCreateKeyExA RegSetValueExA CloseServiceHandle ControlService CreateServiceA DeleteService OpenSCManagerA OpenServiceA StartServiceA GetUserNameA GetTokenInformation GetLengthSid CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptAcquireContextA CryptGetHashParam ConvertSidToStringSidA CopySid IsValidSid OpenProcessToken

shell32

ShellExecuteA ShellExecuteW

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_function_call@std@@YAXXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

ntdll

RtlImageNtHeader

normaliz

IdnToAscii

wldap32

ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord30 ord200 ord301

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore

ws2_32

gethostname listen closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons ntohs sendto recvfrom setsockopt freeaddrinfo socket WSASetLastError WSAIoctl WSAStartup ntohl getaddrinfo WSACleanup accept select __WSAFDIsSet htonl ioctlsocket

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

_CxxThrowException __std_exception_destroy __C_specific_handler __current_exception_context __current_exception memchr strstr strrchr strchr __std_exception_copy memcmp __std_terminate memset memmove memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcscmp strncmp strlen strncpy _strdup tolower strpbrk strcmp strcspn strspn _stricmp strcat_s strcpy_s wcsncpy_s wcslen isupper

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc realloc _set_new_mode calloc

api-ms-win-crt-stdio-l1-1-0

setvbuf fwrite _set_fmode _lseeki64 __acrt_iob_func _get_stream_buffer_pointers __stdio_common_vfprintf _fseeki64 ftell __p__commode fsetpos fseek feof _read _write _close _open fclose fflush fread __stdio_common_vsscanf __stdio_common_vsprintf fgetc fputs fgetpos fopen fputc _pclose fgets _popen ungetc

api-ms-win-crt-filesystem-l1-1-0

_unlink _lock_file _fstat64 _access _unlock_file _stat64

api-ms-win-crt-runtime-l1-1-0

__sys_nerr strerror _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn system _register_thread_local_exe_atexit_callback _c_exit _beginthreadex __p___argv __p___argc abort _getpid _exit _initterm_e _initterm exit _errno _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type _resetstkoflw _get_initial_narrow_environment

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-convert-l1-1-0

strtol strtoull atoi strtoll strtod strtoul

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_fe79f416d8f4ad6fe128ffc16bda5697_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

kernel32

user32

advapi32

shell32

msvcp140

ntdll

normaliz

wldap32

crypt32

ws2_32

psapi

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic