General
- Target 2026-07-07_ecbe7419751dde1790e2b1ce18eaf43d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.7MB
- Sample260707-ntrwbsd15k
- SHA256 4e57d1f667a7d3a9a879a7f237b9399ccf2c9952c5904a80e6ec5b2355769c15
- MD5 ecbe7419751dde1790e2b1ce18eaf43d
- SHA1 e61188350e1154cc2a942d950b6305c0b3966826
- SHA512 0b8b4d581a14aed7d23556e63c328e112e5bc170c6da504d6ec5bfe81dfd9210a88f7f7400668f4eb356b68e498c42cc8f6e004aa54a3823dcfdbbc85c56713a
- SSDEEP 98304:yaytBxqFVdaUoNVaGaB1z4XNqq5tP7bnAyhVGi08:yBeVjkNl5lnh8
- TLSH T100A66B13F29901D8E06ED5788B6A5232A972BC8A4B30B2DF3A5C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_ecbe7419751dde1790e2b1ce18eaf43d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_ecbe7419751dde1790e2b1ce18eaf43d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.7MB
- SHA256 4e57d1f667a7d3a9a879a7f237b9399ccf2c9952c5904a80e6ec5b2355769c15
- MD5 ecbe7419751dde1790e2b1ce18eaf43d
- SHA1 e61188350e1154cc2a942d950b6305c0b3966826
- SHA512 0b8b4d581a14aed7d23556e63c328e112e5bc170c6da504d6ec5bfe81dfd9210a88f7f7400668f4eb356b68e498c42cc8f6e004aa54a3823dcfdbbc85c56713a
- SSDEEP 98304:yaytBxqFVdaUoNVaGaB1z4XNqq5tP7bnAyhVGi08:yBeVjkNl5lnh8
- TLSH T100A66B13F29901D8E06ED5788B6A5232A972BC8A4B30B2DF3A5C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1