General
- Target 2026-04-24_668cfd3a4e43966d84fae418d82dd7e8_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
- Size 46.4MB
- Sample260424-ek4dbset61
- SHA256 5430f61f5486d176b92596cfb3e2891daaa1e9cd172e06a9cb6c76a3c98162de
- MD5 668cfd3a4e43966d84fae418d82dd7e8
- SHA1 a4edabac8069007bbd2a79e36911c25a187e26f8
- SHA512 aba215f7ce5592438618e4cf3f9436750a2e907db6428e9ed9cf95c37de0c09c5af565d077039f3ca3a76f5a8b3306fc1811d911361ab5bf4080c5b94182a254
- SSDEEP 393216:0z9acPaemDUSCMWtu2hsnoKEtKDengbdK7fVJf7CGVZBS9MgDKGo9QwJOsG1doxQ:jRK9J7wb+iG8xm0
- TLSH T144B77C9673F441EAE1AED134C9678A37EAB1BC451430434B2560FB9BAF33660AD3D361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_668cfd3a4e43966d84fae418d82dd7e8_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260130-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_668cfd3a4e43966d84fae418d82dd7e8_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11-20260130-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-24_668cfd3a4e43966d84fae418d82dd7e8_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm
- Size 46.4MB
- SHA256 5430f61f5486d176b92596cfb3e2891daaa1e9cd172e06a9cb6c76a3c98162de
- MD5 668cfd3a4e43966d84fae418d82dd7e8
- SHA1 a4edabac8069007bbd2a79e36911c25a187e26f8
- SHA512 aba215f7ce5592438618e4cf3f9436750a2e907db6428e9ed9cf95c37de0c09c5af565d077039f3ca3a76f5a8b3306fc1811d911361ab5bf4080c5b94182a254
- SSDEEP 393216:0z9acPaemDUSCMWtu2hsnoKEtKDengbdK7fVJf7CGVZBS9MgDKGo9QwJOsG1doxQ:jRK9J7wb+iG8xm0
- TLSH T144B77C9673F441EAE1AED134C9678A37EAB1BC451430434B2560FB9BAF33660AD3D361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Modifies system executable filetype association