2026-04-23_54fb9145b461be57d167fa10b8091118_chir_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-23_54fb9145b461be57d167fa10b8091118_chir_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
Size 4.1MB
Sample260423-gh8ldact41
SHA256 9b880c039f61e80729de7db10b59c66242dfaeb4988985efbbffab3b228f7c27
MD5 54fb9145b461be57d167fa10b8091118
SHA1 0140d3ea693de3942f2ad87dc2c78da83a2013ca
SHA512 2757b56319fda49a3d33a6f9d628b3cd4ef286808cf01fabae573a35d03252ec356c308d84f53c7bef52c3b3d98dfd971c74b58632d31e31254b6e5a9e9195b6
SSDEEP 49152:CnmjRWgZLg1VCVRyDOHizwWK3QCMCzKlalPGJZ/BdYaZruX7UCeS:QQEP2EDlalPGJZpdYPXeS
TLSH
T1AA162A53F19106A8D519C171CE9B86209B25BC184BF1AEEF36C0B7E52EB39D03B76B44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-04-23_54fb9145b461be57d167fa10b8091118_chir_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

File Explorer

2026-04-23_54fb9145b461be57d167fa10b8091118_chir_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

.exe 4.1MB

2026-04-23_54fb9145b461be57d167fa10b8091118_chir_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

IMPHASH 8208e673a894b704a8f4a452053b06e3
SHA256 9b880c039f61e80729de7db10b59c66242dfaeb4988985efbbffab3b228f7c27
MD5 54fb9145b461be57d167fa10b8091118
SHA1 0140d3ea693de3942f2ad87dc2c78da83a2013ca
SHA512 2757b56319fda49a3d33a6f9d628b3cd4ef286808cf01fabae573a35d03252ec356c308d84f53c7bef52c3b3d98dfd971c74b58632d31e31254b6e5a9e9195b6
SSDEEP 49152:CnmjRWgZLg1VCVRyDOHizwWK3QCMCzKlalPGJZ/BdYaZruX7UCeS:QQEP2EDlalPGJZpdYPXeS
TLSH
T1AA162A53F19106A8D519C171CE9B86209B25BC184BF1AEEF36C0B7E52EB39D03B76B44
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4f:e5:48:29:67:72:6c:5d:d3:55:2c:8b:b7:63:a4:4b:c3:f8:f9:8f:9f:9e:7a:65:51:27:d8:e4:04:f4:a7:48

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 24, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 16, 2023 - Jan 31, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b4:fb:80:08:44:05:d2:2d:fa:00:01:00:00:01:b4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

1078014609

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\e\src\out\Release\win_clang_nacl_win64\nacl64.exe.pdb

advapi32

AccessCheck AddMandatoryAce AdjustTokenPrivileges BuildTrusteeWithSidW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW CreateProcessWithTokenW CreateRestrictedToken CreateWellKnownSid CryptAcquireContextW CryptGenRandom CryptReleaseContext DuplicateTokenEx EqualSid EventRegister EventSetInformation EventUnregister EventWrite FreeSid GetAce GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo GetTokenInformation InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegDisablePredefinedCache RegGetValueW RegOpenKeyExW RegQueryValueExW RevertToSelf SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

winmm

timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetTime

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEventSelect WSAGetLastError WSAStartup accept bind closesocket gethostbyname getsockname htonl htons listen ntohs recv select send setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AllocConsole AssignProcessToJobObject AttachConsole CancelIo CloseHandle CompareStringW ConnectNamedPipe ContinueDebugEvent CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DebugActiveProcess DebugBreak DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeHandleStateW GetNamedPipeServerProcessId GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessHeaps GetProcessId GetProcessMitigationPolicy GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAsFileTime GetSystemWow64DirectoryW GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32EnumProcessModules K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile MapViewOfFileEx MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW QueryDosDeviceW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetDefaultDllDirectories SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessMitigationPolicy SetStdHandle SetThreadAffinityMask SetThreadContext SetThreadInformation SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForDebugEvent WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory lstrcmpiW lstrlenA

user32

AllowSetForegroundWindow CloseDesktop CloseWindowStation CreateDesktopW CreateWindowExW CreateWindowStationW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetProcessWindowStation GetQueueStatus GetThreadDesktop GetUserObjectInformationW GetWindowLongPtrW KillTimer MessageBoxW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterPowerSettingNotification SetProcessWindowStation SetTimer SetWindowLongPtrW TranslateMessage UnregisterClassW UnregisterPowerSettingNotification wsprintfW

ntdll

NtClose NtOpenKeyEx NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlGetLastNtStatus RtlInitUnicodeString

userenv

CreateAppContainerProfile CreateEnvironmentBlock DeriveAppContainerSidFromAppContainerName DestroyEnvironmentBlock GetProfileType

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

184B

Characteristics

Name

.tls

Size

1024B

Virtual Size

545B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

230B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

MLA

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-23_54fb9145b461be57d167fa10b8091118_chir_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

PE Signature issue

advapi32

dbghelp

winmm

ws2_32

kernel32

user32

ntdll

userenv

shell32

version

ole32

generic