2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 4.9MB
Sample260511-2cbdxabs4y
SHA256 acfa3c6f7ffd0c2a05b04246d217c6dedd1faa44e0def35525aa0e843dabc6df
MD5 eda2e0fea6189accba36a18679e94109
SHA1 b0b6833ed6a1dd98246ab880ccfe4b658e2d69f9
SHA512 45c2bbcb17f44a10763a68839adc3828a37e734096830f8a30dfa12334c7b3b451574008130daca99a1cd8c8e2ff8ef56397c529952317a7cf3694e911e6c19c
SSDEEP 98304:yHJW97BuXwK/lgQ/6SS/lgQ/6SBDxRQL:yHJW97BuXmGvGBDx
TLSH
T18436BE4FE3A345E9C2B2E13CE5817327F5723424933563E76BC50A1A9F967E099B9320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 4.9MB

2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 19e86f1226287f8927fb661a80dccecc
SHA256 acfa3c6f7ffd0c2a05b04246d217c6dedd1faa44e0def35525aa0e843dabc6df
MD5 eda2e0fea6189accba36a18679e94109
SHA1 b0b6833ed6a1dd98246ab880ccfe4b658e2d69f9
SHA512 45c2bbcb17f44a10763a68839adc3828a37e734096830f8a30dfa12334c7b3b451574008130daca99a1cd8c8e2ff8ef56397c529952317a7cf3694e911e6c19c
SSDEEP 98304:yHJW97BuXwK/lgQ/6SS/lgQ/6SBDxRQL:yHJW97BuXmGvGBDx
TLSH
T18436BE4FE3A345E9C2B2E13CE5817327F5723424933563E76BC50A1A9F967E099B9320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1423568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\krmv\Desktop\Yeni klasör (5)\KRMVHACK\AV_X\x64\Release\Loader.pdb

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

mouse_event wsprintfW SetLayeredWindowAttributes ShowWindow RegisterClassExW CreateWindowExW GetWindowRect DefWindowProcW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow IsChild ClientToScreen GetCapture ScreenToClient GetKeyState GetWindowTextW IsIconic SetForegroundWindow FindWindowA FindWindowW TranslateMessage EnumWindows MoveWindow MessageBoxA PeekMessageW DispatchMessageW GetClassNameA GetSystemMetrics SetWindowPos FindWindowExW SetWindowLongW GetWindowLongW SendInput GetAsyncKeyState

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFullPathNameW GetCurrentDirectoryW HeapReAlloc HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA GetModuleFileNameW IsProcessorFeaturePresent SetFilePointerEx FreeLibraryAndExitThread ExitThread CreateThread FileTimeToSystemTime SetConsoleTextAttribute GetStdHandle Sleep GetModuleFileNameA OutputDebugStringA GetTickCount64 ExitProcess GetTickCount VirtualProtectEx MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter WriteFile WaitForSingleObject OpenProcess GetTempPathA GetLastError CreateFileA DeleteFileA CloseHandle EnumSystemLocalesW GetExitCodeProcess SetWaitableTimer CreateWaitableTimerW SizeofResource GetACP FindResourceA CreateToolhelp32Snapshot FindFirstFileExW LockResource Process32FirstW LoadResource ReadProcessMemory VirtualQueryEx QueryDosDeviceW VirtualFree DeviceIoControl VirtualAlloc CreateFileW SetLastError FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA GetModuleHandleA VerifyVersionInfoA WaitForSingleObjectEx ExpandEnvironmentStringsA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetFileSizeEx GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable GetStringTypeW CompareStringEx GetCPInfo RtlUnwind GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SystemTimeToTzSpecificLocalTime SetStdHandle FlushFileBuffers GetFileAttributesExW CreateProcessW GetTimeZoneInformation CreateProcessA FindClose GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW TerminateProcess GetCurrentProcess FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry FindNextFileW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW Process32NextW IsValidCodePage SetEnvironmentVariableW GetProcessHeap SetEndOfFile HeapSize WriteConsoleW WriteProcessMemory SetUnhandledExceptionFilter

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

ws2_32

recv send socket htonl accept ioctlsocket getaddrinfo freeaddrinfo ntohl recvfrom sendto closesocket WSACleanup WSAStartup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSASetLastError select gethostname __WSAFDIsSet inet_pton listen WSAGetLastError

wldap32

ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord143

crypt32

CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA CertAddCertificateContextToStore CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCloseStore

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

318KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

dwmapi

d3d11

d3dcompiler_47

user32

kernel32

imm32

ws2_32

wldap32

crypt32

generic