General
- Target 2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.9MB
- Sample260517-genf2acy6s
- SHA256 a652bcc6f923cf07d1b5a7fc57c31d67ffe979ad0d909ec4037a14b98246d4e9
- MD5 eebddb5bb9b55daeed8020ed44d88fc3
- SHA1 2b4020916da5f395a885feb2e72eddebecf3ec37
- SHA512 ef19bccb75dc6d95ea9de3469ea35bca896243394971cc92fee0ad25325408a7b563a17feb49c4e01de24412684a1d91875eb0ce35dacc1fc73e848ec2523390
- SSDEEP 98304:nAW3TxgcOcB5PezCSxHUo3kaW6GoOMDdxaJ97DwsCnLm:nAItcddzIHiY7D8nL
- TLSH T13E968D23F2E601E9F06ED1788B6A9232A972BC854B30B2DF075076551E76FE05B3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-17_eebddb5bb9b55daeed8020ed44d88fc3_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.9MB
- SHA256 a652bcc6f923cf07d1b5a7fc57c31d67ffe979ad0d909ec4037a14b98246d4e9
- MD5 eebddb5bb9b55daeed8020ed44d88fc3
- SHA1 2b4020916da5f395a885feb2e72eddebecf3ec37
- SHA512 ef19bccb75dc6d95ea9de3469ea35bca896243394971cc92fee0ad25325408a7b563a17feb49c4e01de24412684a1d91875eb0ce35dacc1fc73e848ec2523390
- SSDEEP 98304:nAW3TxgcOcB5PezCSxHUo3kaW6GoOMDdxaJ97DwsCnLm:nAItcddzIHiY7D8nL
- TLSH T13E968D23F2E601E9F06ED1788B6A9232A972BC854B30B2DF075076551E76FE05B3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1