2026-11-01_a8f202be7223358932cc43a12d750afd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_a8f202be7223358932cc43a12d750afd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 574KB
Sample261102-pjghaahx6x
SHA256 4a7b9e2bc0a78a6c232d73230b517b355dacdb98d3f4f3ba4b52c710ac2d63f8
MD5 a8f202be7223358932cc43a12d750afd
SHA1 9eb8fc4add5a8edaf031340318a4ca1537a8b685
SHA512 48379ff7980a854fd10d1cd3e1c1ed24183556fb0de98659da2397ad6a51e7d545b3735109e6efe7c1505f4f363e4f80650c2894832a1e112075a9287b8866aa
SSDEEP 12288:0A49KhDI0eLaUew5iomaRB7rlJEFeshuPr:0Wh4LaUewAo/3aeyuP
TLSH
T176C45D26A6A801FDE0B7C1B8CA534903E772B8460371AADB07D09AA71F176D55F3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_a8f202be7223358932cc43a12d750afd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-11-01_a8f202be7223358932cc43a12d750afd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 574KB

2026-11-01_a8f202be7223358932cc43a12d750afd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH f5ff6bb867569008c0d00d03674e38db
SHA256 4a7b9e2bc0a78a6c232d73230b517b355dacdb98d3f4f3ba4b52c710ac2d63f8
MD5 a8f202be7223358932cc43a12d750afd
SHA1 9eb8fc4add5a8edaf031340318a4ca1537a8b685
SHA512 48379ff7980a854fd10d1cd3e1c1ed24183556fb0de98659da2397ad6a51e7d545b3735109e6efe7c1505f4f363e4f80650c2894832a1e112075a9287b8866aa
SSDEEP 12288:0A49KhDI0eLaUew5iomaRB7rlJEFeshuPr:0Wh4LaUewAo/3aeyuP
TLSH
T176C45D26A6A801FDE0B7C1B8CA534903E772B8460371AADB07D09AA71F176D55F3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

280432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

steam_api64

SteamAPI_GetHSteamUser SteamInternal_SteamAPI_Init SteamAPI_Shutdown SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamInternal_FindOrCreateGameServerInterface SteamInternal_FindOrCreateUserInterface SteamInternal_ContextInit SteamAPI_RunCallbacks

ws2_32

recv connect closesocket bind getsockname ioctlsocket send inet_ntop inet_pton sendto recvfrom getnameinfo freeaddrinfo getaddrinfo WSAIoctl WSAGetLastError WSACleanup WSAStartup socket setsockopt

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW OpenServiceW OpenSCManagerW CloseServiceHandle GetTokenInformation GetSecurityDescriptorDacl GetSecurityDescriptorControl GetFileSecurityW OpenProcessToken

shell32

CommandLineToArgvW ShellExecuteExW SHGetKnownFolderPath

ole32

CoUninitialize CoInitializeEx StringFromGUID2 CoCreateGuid CoTaskMemFree

kernel32

ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW HeapReAlloc CompareStringW LoadLibraryExW VirtualProtect GetFileType IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW LCMapStringW GetFullPathNameW HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree GetCommandLineW GetCommandLineA ExitProcess GetStdHandle CloseHandle ReleaseMutex WaitForSingleObject CreateMutexW WideCharToMultiByte SetConsoleOutputCP SetEnvironmentVariableA SetWaitableTimerEx CreateWaitableTimerExW GetSystemTime SetConsoleCtrlHandler CreateDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetFileAttributesW GetFileInformationByHandle GetFileSizeEx ReadFile RemoveDirectoryW WriteFile GetTempPathW SetHandleInformation GetLastError CreatePipe PeekNamedPipe CancelSynchronousIo Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetTickCount64 GetModuleFileNameW LocalFree MoveFileExW IsProcessorFeaturePresent FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW RtlUnwind SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId RtlPcToFileHeader RaiseException WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW

Name

.text

Size

414KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_a8f202be7223358932cc43a12d750afd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

steam_api64

ws2_32

advapi32

shell32

ole32

kernel32

generic