2026-07-01_d6b5925b7bcf82c146883db522c95666_avaddon_cobalt-strike_glassworm_icedid_njrat_poet-rat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_d6b5925b7bcf82c146883db522c95666_avaddon_cobalt-strike_glassworm_icedid_njrat_poet-rat_satacom_stealc
Size 2.8MB
Sample260701-wyncpsdw9y
SHA256 8bd261d774902ad66eaaaaff28524b2a2227f7e8946cd2f2298cb9a29d995a8b
MD5 d6b5925b7bcf82c146883db522c95666
SHA1 9ce515309f273e9bcd2005b2bb313d46cb5f7094
SHA512 b7cd2960ab91104b4baef5ca432d3844b4a2fd09adc384fecc5e0b0748752dbe705783981bdbaee296a6be26c009c81bbbc60be0cd6bb6a4e595deca1f4f41f2
SSDEEP 49152:CXGhBb5LtaiCCd6FlUi0FcbQwhv0g051qF3GmCC3ju6Qq4R0FZyGWWL+4Szid6nM:CXJUi
TLSH
T134D57DA5B3AD12E6CF6693F4E6C31F42673F358D372416432264824615BE01C5FBFA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_d6b5925b7bcf82c146883db522c95666_avaddon_cobalt-strike_glassworm_icedid_njrat_poet-rat_satacom_stealc

File Explorer

2026-07-01_d6b5925b7bcf82c146883db522c95666_avaddon_cobalt-strike_glassworm_icedid_njrat_poet-rat_satacom_stealc

.exe 2.8MB

2026-07-01_d6b5925b7bcf82c146883db522c95666_avaddon_cobalt-strike_glassworm_icedid_njrat_poet-rat_satacom_stealc

IMPHASH a7a8aea93116621fce7edb847ab81ec8
SHA256 8bd261d774902ad66eaaaaff28524b2a2227f7e8946cd2f2298cb9a29d995a8b
MD5 d6b5925b7bcf82c146883db522c95666
SHA1 9ce515309f273e9bcd2005b2bb313d46cb5f7094
SHA512 b7cd2960ab91104b4baef5ca432d3844b4a2fd09adc384fecc5e0b0748752dbe705783981bdbaee296a6be26c009c81bbbc60be0cd6bb6a4e595deca1f4f41f2
SSDEEP 49152:CXGhBb5LtaiCCd6FlUi0FcbQwhv0g051qF3GmCC3ju6Qq4R0FZyGWWL+4Szid6nM:CXJUi
TLSH
T134D57DA5B3AD12E6CF6693F4E6C31F42673F358D372416432264824615BE01C5FBFA2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

705456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetMenuBarInfo SetProcessDpiAwarenessContext GetMessageW LoadImageW LoadIconW LoadCursorW OffsetRect FillRect MessageBoxW GetWindowRect GetClientRect RedrawWindow UpdateWindow DrawTextW GetMenuItemInfoW AppendMenuW DestroyMenu CreateMenu DrawMenuBar SetMenu GetMenu GetSystemMetrics TranslateAcceleratorW CreateAcceleratorTableW GetWindowPlacement ShowWindow DestroyWindow CreateWindowExW RegisterClassExW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW PeekMessageW DispatchMessageW TranslateMessage SetProcessDPIAware

ole32

CoUninitialize CoCreateInstance GetHGlobalFromStream CoSetProxyBlanket CoInitializeEx CreateStreamOnHGlobal CoTaskMemFree

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDevicePropertyW CM_Get_DevNode_Status

newdev

UpdateDriverForPlugAndPlayDevicesW DiInstallDriverW

advapi32

OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegDeleteKeyW EventRegister EventSetInformation EventWriteTransfer EventUnregister RegQueryValueExW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegGetValueW RegSetValueExW InitiateSystemShutdownExW RegDeleteTreeW

gdi32

DeleteObject SetBkMode SetTextColor CreateSolidBrush

gdiplus

GdipGetImageWidth GdipGetImageGraphicsContext GdipGetImageHeight GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipBitmapLockBits GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusStartup GdipFree GdipAlloc GdipDeleteGraphics GdipSetInterpolationMode GdipDrawImageRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipBitmapUnlockBits

msi

ord181 ord45 ord179 ord70

shell32

CommandLineToArgvW ShellExecuteW SHFileOperationW ShellExecuteExW SHQueryRecycleBinW SHEmptyRecycleBinW Shell_NotifyIconW SHCreateItemFromParsingName SHCreateDirectoryExW SHGetFolderPathW SHGetKnownFolderPath

winhttp

WinHttpQueryHeaders WinHttpOpenRequest WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpReceiveResponse WinHttpSendRequest

dwmapi

DwmSetWindowAttribute

ws2_32

GetNameInfoW connect ioctlsocket getsockopt htons inet_addr ntohs select socket WSAStartup InetNtopW inet_ntop closesocket WSACleanup

iphlpapi

GetExtendedTcpTable GetAdaptersAddresses SendARP IcmpCreateFile IcmpCloseHandle IcmpSendEcho

wevtapi

EvtFormatMessage EvtRender EvtQuery EvtClose EvtNext EvtOpenPublisherMetadata

wlanapi

WlanQueryInterface WlanGetProfile WlanGetProfileList WlanFreeMemory WlanEnumInterfaces WlanCloseHandle WlanOpenHandle

bcrypt

BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptGetProperty

wintrust

WinVerifyTrust

netapi32

NetUserEnum NetApiBufferFree

kernel32

GetLocalTime GetSystemTimeAsFileTime GlobalMemoryStatusEx GetSystemTimes WriteConsoleW HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW OpenProcess CreateProcessW CreateThread GetExitCodeProcess TerminateProcess GetCurrentProcess Sleep WaitForSingleObject PeekNamedPipe CreatePipe SetHandleInformation CloseHandle GetTempPathW WriteFile SetFilePointer GetEnvironmentStringsW GetCommandLineA FindFirstFileExW GetTickCount64 GetWindowsDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalSize GlobalUnlock GlobalLock LocalFree QueryFullProcessImageNameW CopyFileW MoveFileExW FileTimeToSystemTime GetSystemPowerStatus GetOEMCP GetACP IsValidCodePage SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect GetFileType HeapAlloc HeapReAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess SetFileAttributesW RemoveDirectoryW ReadFile GetLogicalDriveStringsW GetFileSizeEx GetFileSize GetFileAttributesW GetDriveTypeW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader MultiByteToWideChar WideCharToMultiByte K32EnumProcesses K32GetModuleBaseNameW K32GetProcessMemoryInfo DeleteFileW InitializeSListHead GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter HeapFree GetProcessHeap OutputDebugStringW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLastError WaitForSingleObjectEx OutputDebugStringA LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionEx CreateFileW LeaveCriticalSection EnterCriticalSection GetStringTypeW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread CreateDirectoryW CompareFileTime ExpandEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW GetCurrentThreadId

Name

.text

Size

869KB

Virtual Size

868KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_d6b5925b7bcf82c146883db522c95666_avaddon_cobalt-strike_glassworm_icedid_njrat_poet-rat_satacom_stealc

user32

ole32

oleaut32

setupapi

newdev

advapi32

gdi32

gdiplus

msi

shell32

winhttp

dwmapi

ws2_32

iphlpapi

wevtapi

wlanapi

bcrypt

wintrust

netapi32

kernel32

generic