General
- Target 2026-07-04_8aa145731321c444dfb49227cbec5da3_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_tofsee_vidar_xworm
- Size 565KB
- Sample260704-j92m9ahs3m
- SHA256 864fa06606ad9d5d94484fcbecacc80b04267bdb101f893e0ac6251cbfe637bc
- MD5 8aa145731321c444dfb49227cbec5da3
- SHA1 0eccf6d9ca6c68c9ae5e0350b6b6192749a1b329
- SHA512 302e12b380b56cebea0faa3cdc2056f41174c9db62f2b4889acb4ed9710345d335299273fa3ccd1b9fd641c5cbd6a0214305b1d91aafc31c8a8dc8cb6e4e53c7
- SSDEEP 12288:pYCDi50NiQDuysMFZzN/E/msup7sFLA26NdsvKdlg8ClKoTZvvm:693gT2d6BdrClfTpm
- TLSH T128C4BE11F38044F9D5AB807489A68A529E3A7CAF0B71E9DF17DC622A1F337E04E38755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-04_8aa145731321c444dfb49227cbec5da3_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_8aa145731321c444dfb49227cbec5da3_cobalt-strike_glassworm_icedid_redline-stealer_rhadamant.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-04_8aa145731321c444dfb49227cbec5da3_cobalt-strike_glassworm_icedid_redline-stealer_rhadamanthys_ryuk_satacom_smoke-loader_stealc_tofsee_vidar_xworm
- Size 565KB
- SHA256 864fa06606ad9d5d94484fcbecacc80b04267bdb101f893e0ac6251cbfe637bc
- MD5 8aa145731321c444dfb49227cbec5da3
- SHA1 0eccf6d9ca6c68c9ae5e0350b6b6192749a1b329
- SHA512 302e12b380b56cebea0faa3cdc2056f41174c9db62f2b4889acb4ed9710345d335299273fa3ccd1b9fd641c5cbd6a0214305b1d91aafc31c8a8dc8cb6e4e53c7
- SSDEEP 12288:pYCDi50NiQDuysMFZzN/E/msup7sFLA26NdsvKdlg8ClKoTZvvm:693gT2d6BdrClfTpm
- TLSH T128C4BE11F38044F9D5AB807489A68A529E3A7CAF0B71E9DF17DC622A1F337E04E38755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects Windows executables referencing non-Windows User-Agents
Executes dropped EXE
Modifies system executable filetype association