General
- Target 2026-07-01_2a113dcdc4359e7dbf4cb8826052ce1f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 18.1MB
- Sample260702-amp69sgw2p
- SHA256 0853d7095a002072f42500df837ddbd4475256489f2461e9d15ee1ed52e39989
- MD5 2a113dcdc4359e7dbf4cb8826052ce1f
- SHA1 77952eac63b1453ef9dd5bdf3f38d9288b8850e7
- SHA512 a00c5a2c88ed0d88a520512492189f58b7d51c62f7fffa1eb2624eeafa9ec39b030752accb387e794e21921844fba943266c8705e9030002a131555c8fa2b94a
- SSDEEP 393216:GzQtszTKOHi+2ohcyLPk3meXcGfd0saHW8p2/kEv2qvQ/9:GzQtsfKOHiRyc0PaF5F0dW8p2mV
- TLSH T1A6173326E31504D8E4D6953FE190C9391A12785A03BD925B53FCACB61E8F0F5BEBCB90
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-01_2a113dcdc4359e7dbf4cb8826052ce1f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_2a113dcdc4359e7dbf4cb8826052ce1f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260629-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_2a113dcdc4359e7dbf4cb8826052ce1f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 18.1MB
- SHA256 0853d7095a002072f42500df837ddbd4475256489f2461e9d15ee1ed52e39989
- MD5 2a113dcdc4359e7dbf4cb8826052ce1f
- SHA1 77952eac63b1453ef9dd5bdf3f38d9288b8850e7
- SHA512 a00c5a2c88ed0d88a520512492189f58b7d51c62f7fffa1eb2624eeafa9ec39b030752accb387e794e21921844fba943266c8705e9030002a131555c8fa2b94a
- SSDEEP 393216:GzQtszTKOHi+2ohcyLPk3meXcGfd0saHW8p2/kEv2qvQ/9:GzQtsfKOHiRyc0PaF5F0dW8p2mV
- TLSH T1A6173326E31504D8E4D6953FE190C9391A12785A03BD925B53FCACB61E8F0F5BEBCB90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.