2026-11-01_8f77600f4fc672d00d5c5daa98b76e57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_8f77600f4fc672d00d5c5daa98b76e57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 15.8MB
Sample261102-sd8alac14p
SHA256 73a03bc2bd18328a689ab839e363d1626487d4b34cf9ef40ff20282ced0aaf39
MD5 8f77600f4fc672d00d5c5daa98b76e57
SHA1 4072b280ee64d5e8123e5398f447bd8c83ec5c3b
SHA512 45c928b15ac06dbfa2cad4a8fd302555004226ea94a55623173174675a2248e97eda162de89133f9683260a514a52e38f1448edfda7203f7e20a93fe8c77c875
SSDEEP 393216:19a9OM3kCVfH/5BNeNloV/SSawxhJkoP0m6DI:za9OSkCVH/fNeNlZN2iDI
TLSH
T12EF62203F65281ECC55EC478C712C772B732BC890F25A2EB27D46A542E2BBE01E6D795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_8f77600f4fc672d00d5c5daa98b76e57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-11-01_8f77600f4fc672d00d5c5daa98b76e57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 15.8MB

2026-11-01_8f77600f4fc672d00d5c5daa98b76e57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 6359dd54eb743c60e8c517d8438da9db
SHA256 73a03bc2bd18328a689ab839e363d1626487d4b34cf9ef40ff20282ced0aaf39
MD5 8f77600f4fc672d00d5c5daa98b76e57
SHA1 4072b280ee64d5e8123e5398f447bd8c83ec5c3b
SHA512 45c928b15ac06dbfa2cad4a8fd302555004226ea94a55623173174675a2248e97eda162de89133f9683260a514a52e38f1448edfda7203f7e20a93fe8c77c875
SSDEEP 393216:19a9OM3kCVfH/5BNeNloV/SSawxhJkoP0m6DI:za9OSkCVH/fNeNlZN2iDI
TLSH
T12EF62203F65281ECC55EC478C712C772B732BC890F25A2EB27D46A542E2BBE01E6D795
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwrite

DWriteCreateFactory

user32

TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage RegisterClassExW GetWindow GetWindowThreadProcessId EnumWindows IsWindowVisible SendMessageTimeoutW IsHungAppWindow MessageBoxA LoadCursorA GetCursorPos MessageBoxW GetWindowRect GetSystemMetrics ReleaseCapture SetCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoCreateGuid

shlwapi

PathRemoveFileSpecW

advapi32

GetTokenInformation OpenProcessToken RegGetValueW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetProcessHeap GetACP IsValidCodePage GetCommandLineA SetStdHandle HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode HeapSize FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue WriteConsoleW SetEndOfFile GetConsoleOutputCP FindFirstFileExW CreateFileW DeleteFileW WriteFile GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess CreateProcessW LoadResource LockResource SizeofResource FindResourceW WideCharToMultiByte GetFileAttributesW GetModuleFileNameW GetEnvironmentVariableW ExpandEnvironmentStringsW GetLastError WaitForSingleObject CreateRemoteThread GetExitCodeThread GetProcessId OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleW GetModuleHandleExW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW RtlUnwind FindNextFileW GetFileAttributesExW GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TlsGetValue RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_8f77600f4fc672d00d5c5daa98b76e57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

bcrypt

d3d11

d3dcompiler_47

dcomp

dwrite

user32

ole32

shlwapi

advapi32

kernel32

generic