2026-07-01_d6ae8d082d08ad95c39dd6cad2dff254_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar

General

Target
2026-07-01_d6ae8d082d08ad95c39dd6cad2dff254_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar
Size 1.7MB
Sample260701-t2pc3aat2j
SHA256 03db157a7412bd8ea1f0931ce04f6e4e03744bcb35e83bbf7e0a1fcbcd37afca
MD5 d6ae8d082d08ad95c39dd6cad2dff254
SHA1 3c8bd755f2acffd8309ea4df02d52364b9ca45e3
SHA512 af09de2122dfac5c9d2f00b652373b988267efae6530b2a9dfe33372b1651b788b59a795bed9bc527f8812181bffa9197816ee95d4d2670b4aa727082fae9a47
SSDEEP 24576:nslZOZ7y6i1zuxw7ljsarakkqt4jtwcb3Exqatgl8bmwDclqfh1rO:6qy6i1zuajsauZjaoeqatglBS1i
TLSH
T153856D4A73E844E5D5778135C6668552EA72B8222B21D7CF23A0C27D6F337D0AE3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_d6ae8d082d08ad95c39dd6cad2dff254_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar

File Explorer

2026-07-01_d6ae8d082d08ad95c39dd6cad2dff254_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar

.exe 1.7MB

2026-07-01_d6ae8d082d08ad95c39dd6cad2dff254_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar

IMPHASH 6b33b760b2ae51a05bd7a6dade5605b9
SHA256 03db157a7412bd8ea1f0931ce04f6e4e03744bcb35e83bbf7e0a1fcbcd37afca
MD5 d6ae8d082d08ad95c39dd6cad2dff254
SHA1 3c8bd755f2acffd8309ea4df02d52364b9ca45e3
SHA512 af09de2122dfac5c9d2f00b652373b988267efae6530b2a9dfe33372b1651b788b59a795bed9bc527f8812181bffa9197816ee95d4d2670b4aa727082fae9a47
SSDEEP 24576:nslZOZ7y6i1zuxw7ljsarakkqt4jtwcb3Exqatgl8bmwDclqfh1rO:6qy6i1zuajsauZjaoeqatglBS1i
TLSH
T153856D4A73E844E5D5778135C6668552EA72B8222B21D7CF23A0C27D6F337D0AE3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb

kernel32

GetConsoleWindow OutputDebugStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind DeleteCriticalSection InitializeCriticalSectionEx GetLastError UnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW IsDebuggerPresent

user32

GetDesktopWindow SendMessageW FindWindowW ShowWindow

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

ole32

CoInitializeEx CLSIDFromString CoCreateInstance CoAllowSetForegroundWindow

oleaut32

SysAllocString SysFreeString

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memcpy _CxxThrowException __current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit terminate _initterm _get_narrow_winmain_command_line exit _initterm_e _register_thread_local_exe_atexit_callback _exit _seh_filter_exe _cexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _set_app_type _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_d6ae8d082d08ad95c39dd6cad2dff254_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar

kernel32

user32

advapi32

ole32

oleaut32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic