2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc
Size 6.1MB
Sample261104-vz2faayt5j
SHA256 d930a337b5d529fc5e6b7d5d876f765812df8f18961acb5c18a537c82505ddb1
MD5 6fe0776800d54598035bc509616283ba
SHA1 5668ab752cb54ff897006f05a3331fcb0d82cc57
SHA512 9d16408bb54b78af94d79d63f0b79fe301a3ac27f63e15154098b108a8d2bd8ca74d1cb567a7e76aae5d43a6cefe3e406d2ddd71790aa8d3eadffb4f8396467c
SSDEEP 98304:kg+/mRasD4peaZ9We3JMfIs2gToowSZV0ItBk7wRGpj3:52mRbMe89We3JMfIs1DwkSItBwF9
TLSH
T11C56AE66A7A450ECD577C178CA468627E7F2BC1513719BCB02A0967A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

File Explorer

2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

.exe 6.1MB

2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

IMPHASH 8f036a5e58ae7131b54bf9f91b412d71
SHA256 d930a337b5d529fc5e6b7d5d876f765812df8f18961acb5c18a537c82505ddb1
MD5 6fe0776800d54598035bc509616283ba
SHA1 5668ab752cb54ff897006f05a3331fcb0d82cc57
SHA512 9d16408bb54b78af94d79d63f0b79fe301a3ac27f63e15154098b108a8d2bd8ca74d1cb567a7e76aae5d43a6cefe3e406d2ddd71790aa8d3eadffb4f8396467c
SSDEEP 98304:kg+/mRasD4peaZ9We3JMfIs2gToowSZV0ItBk7wRGpj3:52mRbMe89We3JMfIs1DwkSItBwF9
TLSH
T11C56AE66A7A450ECD577C178CA468627E7F2BC1513719BCB02A0967A1F33AE12F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2037464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\steamexe\win64\Release\steamexe.pdb

kernel32

LocalAlloc LocalFree FindResourceA VerifyVersionInfoW SystemTimeToFileTime GetSystemTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW GetFullPathNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GlobalLock SetStdHandle SetConsoleCtrlHandler SetFilePointerEx LCMapStringW DeleteFileW HeapValidate HeapSize WriteConsoleW GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ExitProcess RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW GlobalUnlock GlobalAlloc SizeofResource LockResource LoadResource LoadLibraryExA GetModuleFileNameW GetProductInfo GetVersionExA OpenProcess GetExitCodeProcess GetCurrentProcess WaitForSingleObject SetLastError GetTimeZoneInformation WriteFile CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress GetCurrentThreadId Sleep CreateSymbolicLinkW DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA GetLastError ProcessIdToSessionId GetCurrentProcessId OpenEventA SetEvent SetErrorMode InitializeSListHead SleepConditionVariableSRW GetCPInfo DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetStringTypeW InitOnceComplete InitOnceBeginInitialize TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLogicalProcessorInformationEx GetProcessHeaps SetUnhandledExceptionFilter GetProcessAffinityMask CloseHandle RemoveDirectoryA GetFileAttributesA MultiByteToWideChar LeaveCriticalSection EnterCriticalSection OutputDebugStringA CompareStringW GetCurrentDirectoryW FindNextFileW WideCharToMultiByte RaiseException GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime DeleteFileTransactedW CopyFileExW MoveFileTransactedW ReplaceFileW GetDateFormatW GetTimeFormatW LoadLibraryExW LoadLibraryW FileTimeToSystemTime GlobalFree SetHandleInformation GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent CreateEventA WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent TerminateProcess GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree RtlCaptureStackBackTrace GetCommandLineW DuplicateHandle InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread SetThreadPriority TerminateThread GetExitCodeThread SuspendThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetEnvironmentVariableW SetCurrentDirectoryW OutputDebugStringW CreateProcessW GetCurrentDirectoryA

user32

GetDC GetWindowThreadProcessId EnumWindows IsWindowVisible GetUserObjectInformationW MonitorFromWindow GetProcessWindowStation LoadIconW LoadCursorW EnumChildWindows SetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer SetTimer MsgWaitForMultipleObjects SetWindowPos MoveWindow UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow ShowWindow DestroyWindow CreateWindowExW AllowSetForegroundWindow MonitorFromPoint MessageBoxA GetMonitorInfoW RegisterClassExW DefWindowProcW PostThreadMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW ReleaseDC

gdi32

TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject RemoveFontMemResourceEx AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

ReportEventW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegCloseKey RegCreateKeyExA RegDeleteValueA RegSetValueExW RegQueryValueExW RegSetValueExA RegQueryValueExA RegOpenKeyExA RegisterEventSourceW

shell32

SHGetFileInfoW ord680 SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID CommandLineToArgvW

psapi

GetModuleInformation GetProcessMemoryInfo GetModuleFileNameExW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

version

VerQueryValueW

crypt32

CertCreateCertificateContext CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertGetCertificateChain CertFreeCertificateChain CertCloseStore

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

86KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_6fe0776800d54598035bc509616283ba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_qakbot_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

psapi

api-ms-win-shcore-scaling-l1-1-1

version

crypt32

generic