2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 5.0MB
Sample261102-laqstaay6k
SHA256 7a41c9b5686e2098ef278a80e0eafc36ba12e7a02c52c15776369c36569bbb54
MD5 c4521b5e12dcc2ce4429fa0266f0a00f
SHA1 58dd978604e271d8e92df236aafb78edcb40a41c
SHA512 fed7348eb137d4d447b04faab8d3d633b0fb82e7ed24f83b9219e039d6e7b6870bb5e59025148cf48e3a4dedf78d19e2da123ada3a11b117c38ec43f22dd5b54
SSDEEP 49152:XhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiVHBAxuIEm0qaGy2e:XhVDdV0bHtRjCVjYHkTElX3Su
TLSH
T1D7368D1EE2E8C1A8CCE3C17949464957E6B3383523E1BBCB56A059D77E63FD10A76230
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 5.0MB

2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 96c988111beae19d6f75f54b89a75585
SHA256 7a41c9b5686e2098ef278a80e0eafc36ba12e7a02c52c15776369c36569bbb54
MD5 c4521b5e12dcc2ce4429fa0266f0a00f
SHA1 58dd978604e271d8e92df236aafb78edcb40a41c
SHA512 fed7348eb137d4d447b04faab8d3d633b0fb82e7ed24f83b9219e039d6e7b6870bb5e59025148cf48e3a4dedf78d19e2da123ada3a11b117c38ec43f22dd5b54
SSDEEP 49152:XhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiVHBAxuIEm0qaGy2e:XhVDdV0bHtRjCVjYHkTElX3Su
TLSH
T1D7368D1EE2E8C1A8CCE3C17949464957E6B3383523E1BBCB56A059D77E63FD10A76230
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2118036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader RtlInitUnicodeString RtlUnwindEx RtlCaptureContext RtlUnwind

kernel32

GetFullPathNameA WriteConsoleW GetLastError ExitProcess GetModuleFileNameA GetModuleHandleW GetProcAddress GetFileAttributesA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileW DeleteFileW GetDriveTypeW GetLogicalDriveStringsW GetTempFileNameW SetFileAttributesW WriteFile GetTempPathW WaitForSingleObject FindResourceExW FreeLibrary GetModuleFileNameW LoadLibraryExW LoadResource LockResource SizeofResource EnumResourceNamesW QueryFullProcessImageNameW EnumResourceLanguagesW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetVolumeInformationW GlobalMemoryStatusEx LocalFree GetComputerNameW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GlobalFree FindClose FindFirstFileW FindNextFileW GetFileAttributesExW GetCurrentThreadId GetSystemTime SetUnhandledExceptionFilter ResetEvent CreateEventA ExitThread GetTickCount64 GetSystemInfo GetTimeZoneInformation GetLocalTime GetEnvironmentVariableW CreateDirectoryW GetFileAttributesW GetFileSizeEx GetLongPathNameW QueryDosDeviceW ReadFile RemoveDirectoryW CloseHandle SetEvent CreateMutexA OpenEventA GetCurrentProcess GetCurrentProcessId CreateThread TerminateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile MoveFileExW MultiByteToWideChar SetDllDirectoryW ExpandEnvironmentStringsW CreateFileA GetDiskFreeSpaceExA GetDriveTypeA GetLogicalDrives SetFilePointerEx GetTempPathA SetErrorMode CreatePipe TerminateProcess CreateProcessA CreateProcessW OpenProcess MoveFileW FileTimeToSystemTime K32GetProcessMemoryInfo FlushFileBuffers GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc DeleteFileA GetVersionExA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetDiskFreeSpaceA FormatMessageW Sleep HeapSize HeapValidate GetVersionExW CreateMutexW UnlockFileEx SetEndOfFile SetEnvironmentVariableW SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ConnectNamedPipe PeekNamedPipe CreateNamedPipeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetExitCodeThread InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW GetFileInformationByHandleEx EncodePointer DecodePointer InitializeCriticalSectionEx CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

757KB

Virtual Size

756KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

ntdll

kernel32

generic