2026-06-02_2e64e635dfd19db9cecff0eb19a0942b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_2e64e635dfd19db9cecff0eb19a0942b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 1.7MB
Sample260602-cc6sdaa18v
SHA256 ff8e114567eb194592b31559942b6cc76d398af523b49ce0ecd5a90a281d77b1
MD5 2e64e635dfd19db9cecff0eb19a0942b
SHA1 38d007e292dc885e721d15d0791c0c37b01dff81
SHA512 06a783aebb1a0df99d1ba7a1771412effef45c96332108e36ad1147099b86c5739c295135505680ae87b1ece120fc66237a85c33490dd20c561d854b07b7d630
SSDEEP 24576:uJzikk2C2xQkNrcqpSbkd8zmVK26YtYXI8BahXTRaCGxjI3ulEBU:Eikgbm8z8qYtYXIld0/EBU
TLSH
T19785E54F1EB62BC6C00AD9FF81A614A2BF7660D53B347EFF185081951B41EA9F079E21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_2e64e635dfd19db9cecff0eb19a0942b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-06-02_2e64e635dfd19db9cecff0eb19a0942b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 1.7MB

2026-06-02_2e64e635dfd19db9cecff0eb19a0942b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 24b82c01d56bf1261785d0989d132c99
SHA256 ff8e114567eb194592b31559942b6cc76d398af523b49ce0ecd5a90a281d77b1
MD5 2e64e635dfd19db9cecff0eb19a0942b
SHA1 38d007e292dc885e721d15d0791c0c37b01dff81
SHA512 06a783aebb1a0df99d1ba7a1771412effef45c96332108e36ad1147099b86c5739c295135505680ae87b1ece120fc66237a85c33490dd20c561d854b07b7d630
SSDEEP 24576:uJzikk2C2xQkNrcqpSbkd8zmVK26YtYXI8BahXTRaCGxjI3ulEBU:Eikgbm8z8qYtYXIld0/EBU
TLSH
T19785E54F1EB62BC6C00AD9FF81A614A2BF7660D53B347EFF185081951B41EA9F079E21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

505364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opencl

clCreateCommandQueue clGetPlatformIDs clGetPlatformInfo clGetDeviceIDs clGetDeviceInfo clCreateContext clReleaseContext clReleaseCommandQueue clCreateBuffer clReleaseMemObject clCreateProgramWithSource clReleaseProgram clBuildProgram clGetProgramBuildInfo clCreateKernel clReleaseKernel clSetKernelArg clFinish clEnqueueReadBuffer clEnqueueWriteBuffer clEnqueueFillBuffer clEnqueueNDRangeKernel

wldap32

ord217 ord143 ord30 ord46 ord211 ord60 ord45 ord50 ord301 ord200 ord41 ord79 ord35 ord33 ord32 ord27 ord26 ord22

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertAddCertificateContextToStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

ws2_32

htonl __WSAFDIsSet select socket WSAIoctl bind connect htons send WSAGetLastError WSASetLastError recv closesocket getpeername getsockopt ntohs setsockopt WSAStartup WSACleanup getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname ntohl getsockname

normaliz

IdnToAscii

kernel32

GetConsoleMode WriteFile SetFilePointerEx SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW ReadConsoleW SetStdHandle GetCommandLineA GetModuleHandleExW ExitProcess InitializeCriticalSectionAndSpinCount GetConsoleCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation GetCurrentDirectoryW RtlUnwindEx RaiseException RtlPcToFileHeader GetCPInfo GetStringTypeW LCMapStringEx CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseMutex WaitForSingleObject SleepEx CreateMutexA CreateEventA Sleep WaitForMultipleObjects CreateThread ExitThread GetExitCodeThread TlsAlloc TlsGetValue FindFirstFileExW TlsFree FreeLibrary GetProcAddress LoadLibraryW GetCommandLineW LocalFree WideCharToMultiByte SetConsoleCtrlHandler LoadLibraryExA FindClose GetLastError QueryPerformanceCounter QueryPerformanceFrequency HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetCurrentProcessId RtlUnwind GetCurrentThreadId FreeLibraryAndExitThread GetModuleHandleA LoadLibraryA VerSetConditionMask CreateFileW GetFullPathNameW SetLastError GetModuleFileNameW GetModuleHandleW LoadLibraryExW FileTimeToSystemTime InitializeCriticalSectionEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe FormatMessageA CreateFileA GetFileSizeEx MultiByteToWideChar DecodePointer EncodePointer InitializeSListHead FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetFileAttributesExW SetEndOfFile HeapSize WriteConsoleW TlsSetValue SwitchToThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime

shell32

CommandLineToArgvW

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegQueryValueExW RegOpenKeyExW RegCloseKey

Name

.text

Size

699KB

Virtual Size

699KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

234KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nv_fatb

Size

756KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nvFatBi

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=71, id=260, version=26715,

count=27, id=259, version=26715,

count=199, id=261, version=26715,

count=6, id=253, version=28518,

count=80, id=261, version=29804,

count=19, id=260, version=29804,

count=10, id=259, version=29804,

count=14, id=257, version=26715,

count=3, id=203, productName=VS2012 build 50727, version=50727,

count=302, id=1, productName=Unmarked objects,

count=103, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=10, id=260, version=25830,

count=1, id=206, productName=VS2012 build 50727, version=50727,

count=15, id=207, productName=VS2012 build 50727, version=50727,

count=2, id=260, version=29912,

count=8, id=261, version=29912,

count=1, id=256, version=29912,

count=1, id=255, version=29912,

count=1, id=258, version=29912,