General
- Target 2026-07-09_36f3edcd5203b76f5f913396ee5fd709_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 4.3MB
- Sample260709-p679hsbz9t
- SHA256 bf54caad3af335e98cb7d6dc4bc073e5debe34b4f5326997cdfc087333318b27
- MD5 36f3edcd5203b76f5f913396ee5fd709
- SHA1 949c49a730ba364bbb62f5d3d95859cd7647f534
- SHA512 381a0863d736ce10a5298485adbfe61c120cbd5a755ad83c6ee1bfb3d10f71ed00b6cc55a56c344632894de727e2ad33f07d5223e9162fce859fd0d63cc2fa89
- SSDEEP 49152:/uI28RThbyPo8UkTxLe/S+zZOPW9FtYl/7uWk1xwdqkdeEhrAfAdeArgTncB+v3f:T28AxL4lxmKw3rrJwKrEhyFU
- TLSH T1B0269D03F5DA41D8C02AD1B9874A8232EA61BC456B35B6EF075076252F7AFE49F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_36f3edcd5203b76f5f913396ee5fd709_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_36f3edcd5203b76f5f913396ee5fd709_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 4.3MB
- SHA256 bf54caad3af335e98cb7d6dc4bc073e5debe34b4f5326997cdfc087333318b27
- MD5 36f3edcd5203b76f5f913396ee5fd709
- SHA1 949c49a730ba364bbb62f5d3d95859cd7647f534
- SHA512 381a0863d736ce10a5298485adbfe61c120cbd5a755ad83c6ee1bfb3d10f71ed00b6cc55a56c344632894de727e2ad33f07d5223e9162fce859fd0d63cc2fa89
- SSDEEP 49152:/uI28RThbyPo8UkTxLe/S+zZOPW9FtYl/7uWk1xwdqkdeEhrAfAdeArgTncB+v3f:T28AxL4lxmKw3rrJwKrEhyFU
- TLSH T1B0269D03F5DA41D8C02AD1B9874A8232EA61BC456B35B6EF075076252F7AFE49F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1