General
- Target 2026-07-07_bf37f975225f85b410abd116b2b4aef5_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
- Size 6.1MB
- Sample260707-2m13baf17m
- SHA256 584eddf4a0d4e72a13c42317d87e40cd927920eccb981fbc6593a945b437468e
- MD5 bf37f975225f85b410abd116b2b4aef5
- SHA1 3c9c155e19554b3c8c3a61ad3ea99d1eb3de90a5
- SHA512 eefcee2c1a3baa905bffe5ade39f330c32994b55ce45ab12eb3d82aabe3b5956f6fa9c2441819e723629b8dc11459e92f71c6d3ee875ac8c24c46e1ae41f3c8c
- SSDEEP 196608:gXVP1Vh/L2V2nNgwQ+dtLeax7kIgK6EgyzY:w9VtL2VqNjT78K6Z
- TLSH T11456330533200DECEAB68479C443D425CA75786B6355C7CB07E4DAA33F076B1BDBAA92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Behavioral task
behavioral1
Sample
2026-07-07_bf37f975225f85b410abd116b2b4aef5_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_bf37f975225f85b410abd116b2b4aef5_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_bf37f975225f85b410abd116b2b4aef5_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
- Size 6.1MB
- SHA256 584eddf4a0d4e72a13c42317d87e40cd927920eccb981fbc6593a945b437468e
- MD5 bf37f975225f85b410abd116b2b4aef5
- SHA1 3c9c155e19554b3c8c3a61ad3ea99d1eb3de90a5
- SHA512 eefcee2c1a3baa905bffe5ade39f330c32994b55ce45ab12eb3d82aabe3b5956f6fa9c2441819e723629b8dc11459e92f71c6d3ee875ac8c24c46e1ae41f3c8c
- SSDEEP 196608:gXVP1Vh/L2V2nNgwQ+dtLeax7kIgK6EgyzY:w9VtL2VqNjT78K6Z
- TLSH T11456330533200DECEAB68479C443D425CA75786B6355C7CB07E4DAA33F076B1BDBAA92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.