General
- Target 2026-06-30_0ebca42de90a7a88ea305b822e06ded7_cobalt-strike_glassworm_icedid_njrat_qakbot_satacom_stealc
- Size 12.3MB
- Sample260701-g7bb6sas5w
- SHA256 5509749251522c923b2a858ccd103508d815f5a0452f2777e72b70e5eb78376a
- MD5 0ebca42de90a7a88ea305b822e06ded7
- SHA1 c9bd884eb66c7e477ce30431f572d805973b4e07
- SHA512 40b98509ce919120885083d9c645734c605c6a76c5153ab366f6673f880e04c02b7ec2d00240b867795b0ab9b9ecb4f39f04db65973c04a2bc2fdc820d2ae453
- SSDEEP 98304:/jEeQ10qcAGs0Njs9GU2a9P++NbXQLTEM8E/G0kES0gN0OYZCvx:/ARijsB2a9PVbsTElE/O10gNfYZCv
- TLSH T16ED67C15B7A580E9D41A85348D9FDB8EE7B2BC040B2197DB32D1336E6E337D02E7A611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_0ebca42de90a7a88ea305b822e06ded7_cobalt-strike_glassworm_icedid_njrat_qakbot_satacom_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_0ebca42de90a7a88ea305b822e06ded7_cobalt-strike_glassworm_icedid_njrat_qakbot_satacom_stealc.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_0ebca42de90a7a88ea305b822e06ded7_cobalt-strike_glassworm_icedid_njrat_qakbot_satacom_stealc
- Size 12.3MB
- SHA256 5509749251522c923b2a858ccd103508d815f5a0452f2777e72b70e5eb78376a
- MD5 0ebca42de90a7a88ea305b822e06ded7
- SHA1 c9bd884eb66c7e477ce30431f572d805973b4e07
- SHA512 40b98509ce919120885083d9c645734c605c6a76c5153ab366f6673f880e04c02b7ec2d00240b867795b0ab9b9ecb4f39f04db65973c04a2bc2fdc820d2ae453
- SSDEEP 98304:/jEeQ10qcAGs0Njs9GU2a9P++NbXQLTEM8E/G0kES0gN0OYZCvx:/ARijsB2a9PVbsTElE/O10gNfYZCv
- TLSH T16ED67C15B7A580E9D41A85348D9FDB8EE7B2BC040B2197DB32D1336E6E337D02E7A611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.