2026-04-16_047d22948bcc8e9b94a0978c13a05b41_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_047d22948bcc8e9b94a0978c13a05b41_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 1.2MB
Sample260416-pgaxqaev7l
SHA256 fb68d91bdcf9a2cb2f490eead7c75747f3a20a46238b40e89d64677b6e8c8f69
MD5 047d22948bcc8e9b94a0978c13a05b41
SHA1 670a5a299bfa22917fb0e94cd12a22f25f39306c
SHA512 a786f1e818dd10316b18b94a8fe0b8bfc061731285c847fe0365ff69500340ad5508df165a545fb57cce1bddc1092249ff754581c2801c22d2cd045741cb2afb
SSDEEP 24576:nu3sgsnLdd/AnH5X5pq/nQ/tbw/2Mkjy6Fr7g0oL:nu8gc5JuHt5pq/Q/lFTjN4
TLSH
T1B945DFAAB3A48BE9D867C03CC9034506F7B2B894179197CB13A4436E5F337D61E3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_047d22948bcc8e9b94a0978c13a05b41_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-04-16_047d22948bcc8e9b94a0978c13a05b41_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 1.2MB

2026-04-16_047d22948bcc8e9b94a0978c13a05b41_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 9691aacbd1408eeda1d1355f05399170
SHA256 fb68d91bdcf9a2cb2f490eead7c75747f3a20a46238b40e89d64677b6e8c8f69
MD5 047d22948bcc8e9b94a0978c13a05b41
SHA1 670a5a299bfa22917fb0e94cd12a22f25f39306c
SHA512 a786f1e818dd10316b18b94a8fe0b8bfc061731285c847fe0365ff69500340ad5508df165a545fb57cce1bddc1092249ff754581c2801c22d2cd045741cb2afb
SSDEEP 24576:nu3sgsnLdd/AnH5X5pq/nQ/tbw/2Mkjy6Fr7g0oL:nu8gc5JuHt5pq/Q/lFTjN4
TLSH
T1B945DFAAB3A48BE9D867C03CC9034506F7B2B894179197CB13A4436E5F337D61E3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BWA\82CC4D57-E68E-0\iTunesWin-1200.12.11.3.7\srcroot\iTunes\iPodSupport\(Win32)\BuildResults\Production64\bin\iPodService.pdb

cfgmgr32

CM_Get_Parent CM_Get_DevNode_Status CM_Get_Device_ID_Size CM_Get_Device_IDA CM_Setup_DevNode CM_Query_And_Remove_SubTreeW CMP_WaitNoPendingInstallEvents

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceInstallParamsA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo

rpcrt4

UuidFromStringW UuidCompare

kernel32

SetEvent WaitForSingleObject CreateEventA Sleep WaitForMultipleObjects GetCurrentProcess CreateThread GetCurrentThread lstrcpyA CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection OpenEventA TerminateThread GetExitCodeThread CreateFileA DeviceIoControl GetOverlappedResult LoadLibraryA GetFileSize ReadFile GetVolumeInformationA GetTickCount GetTimeZoneInformation FlushFileBuffers WriteFile TryEnterCriticalSection GetFileAttributesA GetLogicalDrives GetDiskFreeSpaceExA GetFileAttributesExA InitializeCriticalSectionAndSpinCount GetLogicalDriveStringsA CreateFileW SetFilePointer GetModuleFileNameW CopyFileW ReleaseSemaphore CreateSemaphoreA VerSetConditionMask HeapSetInformation LoadLibraryW VerifyVersionInfoA LocalFree WriteConsoleW GetConsoleMode GetConsoleCP SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetCPInfo GetFileType IsDBCSLeadByte WideCharToMultiByte MultiByteToWideChar SetDllDirectoryA FindResourceA lstrcmpiA SizeofResource LoadResource LoadLibraryExA GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA FreeLibrary GetCurrentThreadId CreateMutexA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetErrorMode GetLastError RaiseException CloseHandle DecodePointer GetCommandLineA LCMapStringW CompareStringW HeapReAlloc HeapSize HeapAlloc HeapFree GetStdHandle ExitProcess OutputDebugStringA GetLocalTime GetModuleHandleExW FreeLibraryAndExitThread ExitThread VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError RtlUnwindEx RtlPcToFileHeader OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime GetCurrentProcessId

user32

CharNextW MessageBoxA GetMessageA TranslateMessage CharNextA wsprintfA SendMessageA RegisterDeviceNotificationA CharUpperA PostThreadMessageA DispatchMessageA DestroyWindow UnregisterDeviceNotification GetPropA SetPropA SetTimer DefWindowProcA CreateWindowExA RegisterClassA PostQuitMessage LoadStringA

advapi32

RegSetValueExA SetSecurityDescriptorDacl DeregisterEventSource RegisterEventSourceA ReportEventA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegGetValueA RegQueryValueExW RegOpenKeyExW UnlockServiceDatabase QueryServiceStatusEx LockServiceDatabase ChangeServiceConfig2A SetSecurityDescriptorOwner SetSecurityDescriptorGroup IsValidSid GetTokenInformation GetLengthSid CopySid OpenThreadToken OpenProcessToken StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle RegEnumKeyExA RegQueryValueExA RegQueryInfoKeyW RegQueryInfoKeyA RegOpenKeyExA InitializeSecurityDescriptor

ole32

IIDFromString CoInitializeSecurity CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoUninitialize CoTaskMemRealloc CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoInitializeEx

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringByteLen UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarUI4FromStr

Name

.text

Size

370KB

Virtual Size

370KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_047d22948bcc8e9b94a0978c13a05b41_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

cfgmgr32

setupapi

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

generic