General
- Target 2026-05-16_4ec9ab5408ddf1e448d399907ce9ab1c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.9MB
- Sample260516-dbcctaav31
- SHA256 dd45ec2a0f71c22cea4b098e0f2395dc6a06953eaccf30d14723d91d17b7ac5f
- MD5 4ec9ab5408ddf1e448d399907ce9ab1c
- SHA1 e4f06e7d74f885f4499fb39a5c7d2605d3777425
- SHA512 028bcee5ab282cd308aaab2a0f0965f33d2a497a4a5a42a14bce634af7315506e9c1ecabf02b18aa070a0194abf020cf2899e5aa1cecc63e26a45e4f3ec2b941
- SSDEEP 98304:SAW3TxgcOcB5PezCSxHUo3/aW6GoOMDdxaJ97DwsCdDWGoZqnc:SAItcddCIHiY7D8dytq
- TLSH T1C9967D23F2E601E9F06ED1788B6A9232A972BC854B30B2DF075076551E76FE05B3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_4ec9ab5408ddf1e448d399907ce9ab1c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-16_4ec9ab5408ddf1e448d399907ce9ab1c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.9MB
- SHA256 dd45ec2a0f71c22cea4b098e0f2395dc6a06953eaccf30d14723d91d17b7ac5f
- MD5 4ec9ab5408ddf1e448d399907ce9ab1c
- SHA1 e4f06e7d74f885f4499fb39a5c7d2605d3777425
- SHA512 028bcee5ab282cd308aaab2a0f0965f33d2a497a4a5a42a14bce634af7315506e9c1ecabf02b18aa070a0194abf020cf2899e5aa1cecc63e26a45e4f3ec2b941
- SSDEEP 98304:SAW3TxgcOcB5PezCSxHUo3/aW6GoOMDdxaJ97DwsCdDWGoZqnc:SAItcddCIHiY7D8dytq
- TLSH T1C9967D23F2E601E9F06ED1788B6A9232A972BC854B30B2DF075076551E76FE05B3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1