2026-07-08_0596fcb7cb2de84cde2fea8b4522125e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_0596fcb7cb2de84cde2fea8b4522125e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 600KB
Sample260708-dfry3aay4n
SHA256 e62f04ee18cdffe72d8f2b59a43a4226b7af8091aeb5e647a82daa9f0955ee44
MD5 0596fcb7cb2de84cde2fea8b4522125e
SHA1 c504e4df98304edd038516eb56bf19f86e72b19a
SHA512 812496f9290e0621d932d4ec1357e32d6a4a9bbc5b8173c0de299bcc4eee6ead43231ec8cf9c8f43f23cee61ea1351c2193816129dec211855e362b69c2e045c
SSDEEP 12288:rWcDaEGHNRKVzS+SaVf9nx0C2BfKAD2kzxqmpkR40DXS:jDaEGtR/+S0x09fKA79qrR40DS
TLSH
T1B3D46B1AA6A400F9D0B7C178CE874913FA72B84907759AEF43D15A971F236E09F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENInfoStealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_0596fcb7cb2de84cde2fea8b4522125e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-07-08_0596fcb7cb2de84cde2fea8b4522125e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 600KB

2026-07-08_0596fcb7cb2de84cde2fea8b4522125e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 916bd22c278ca721400551a8dfe90bc7
SHA256 e62f04ee18cdffe72d8f2b59a43a4226b7af8091aeb5e647a82daa9f0955ee44
MD5 0596fcb7cb2de84cde2fea8b4522125e
SHA1 c504e4df98304edd038516eb56bf19f86e72b19a
SHA512 812496f9290e0621d932d4ec1357e32d6a4a9bbc5b8173c0de299bcc4eee6ead43231ec8cf9c8f43f23cee61ea1351c2193816129dec211855e362b69c2e045c
SSDEEP 12288:rWcDaEGHNRKVzS+SaVf9nx0C2BfKAD2kzxqmpkR40DXS:jDaEGtR/+S0x09fKA79qrR40DS
TLSH
T1B3D46B1AA6A400F9D0B7C178CE874913FA72B84907759AEF43D15A971F236E09F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing commands for clearing Windows Event Logs
Detects executables containing common artifacts observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

266912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\lenov\source\repos\BlackReaper\x64\Release\BlackReaper.pdb

shell32

SHGetFolderPathA

ole32

CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

VariantClear SysFreeString VariantInit SysAllocString

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA

gdi32

DeleteObject DeleteDC BitBlt CreateCompatibleDC SelectObject GetDIBits CreateCompatibleBitmap

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegCreateKeyExA GetTokenInformation RegEnumValueA RegEnumKeyExA RegDeleteTreeA RegCloseKey RegQueryValueExA OpenProcessToken

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpReadData WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetOption WinHttpOpen WinHttpReceiveResponse

wininet

InternetReadFile InternetOpenA InternetCloseHandle InternetOpenUrlA

crypt32

CryptBinaryToStringA CryptStringToBinaryA CryptUnprotectData

iphlpapi

GetAdaptersInfo

user32

TranslateMessage UnhookWindowsHookEx GetForegroundWindow GetWindowTextA SetWindowsHookExA GetDC GetSystemMetrics ShowWindow ReleaseDC GetWindowThreadProcessId GetKeyState GetMessageA DispatchMessageA CallNextHookEx GetAsyncKeyState PostThreadMessageA

kernel32

GetExitCodeProcess ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID CreatePipe IsValidCodePage GetACP GetOEMCP CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx WaitForSingleObjectEx GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileType GetCommandLineW GetCommandLineA WriteFile SetEnvironmentVariableW SetStdHandle WriteConsoleW SetEndOfFile GetExitCodeThread CreateProcessW GetStdHandle UnhandledExceptionFilter IsProcessorFeaturePresent DuplicateHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter RaiseException OutputDebugStringW GetStringTypeW ReadFile VirtualProtect HeapFree EnterCriticalSection GetCurrentProcess LeaveCriticalSection InitializeCriticalSectionEx GetModuleHandleA HeapSize GetLastError CreateFileA GetSystemDirectoryA LoadLibraryA HeapReAlloc CloseHandle HeapAlloc DecodePointer GetProcAddress GetFileSize DeleteCriticalSection GetProcessHeap FlushInstructionCache GlobalFree DeleteFileA FreeLibrary GetFileSizeEx WriteProcessMemory TerminateProcess GetModuleFileNameW CreateFileW SuspendThread GetSystemDirectoryW ResumeThread OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Process32NextW Process32FirstW GetThreadContext VirtualAllocEx ExitProcess SetThreadContext WaitForSingleObject K32GetModuleFileNameExA CreateThread GetModuleFileNameA CreateMutexA Sleep GetConsoleWindow CreateProcessA Process32First GetTickCount64 Process32Next GetCurrentProcessId IsDebuggerPresent CheckRemoteDebuggerPresent CopyFileA GetFileAttributesA SetFileAttributesA GetLogicalDrives FindFirstFileA GetDriveTypeA GetUserDefaultUILanguage FindNextFileA FindClose GetVolumeInformationA GetLocaleInfoA GetTempPathA GetTimeZoneInformation LocalFree GlobalMemoryStatusEx WideCharToMultiByte GetDiskFreeSpaceExA FormatMessageA GetComputerNameA WakeAllConditionVariable GetCPInfo CompareStringEx EncodePointer LCMapStringEx QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId GetLocaleInfoEx FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW

ntdll

RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind RtlUnwind

Name

.text

Size

441KB

Virtual Size

441KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_0596fcb7cb2de84cde2fea8b4522125e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

shell32

ole32

oleaut32

setupapi

gdi32

bcrypt

advapi32

winhttp

wininet

crypt32

iphlpapi

user32

kernel32

ntdll

generic