2026-07-10_883cc25338488355d390ad7328e18ea8_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_883cc25338488355d390ad7328e18ea8_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar
Size 2.1MB
Sample260710-dbcnksct5m
SHA256 48447c7e7affec021086e8c0ad1adf1d16259fe7b3c388692d39f8bf4b540c67
MD5 883cc25338488355d390ad7328e18ea8
SHA1 83d0a17ef60e3ff2b069a0abec8238bbc47f998e
SHA512 a472413e87d745e9f3c6a48d8207672c91708e2f8e30a4103c39fd02ade2d72343af8d7c1cb2d039e0f724a6479e0f54edb8e6022e41a063f9f8a6d801e77883
SSDEEP 49152:9dp+Kc7/y4W/JqA96VvQvtiEIypDmg27RnWGj:9Xxc7lvQl7pD527BWG
TLSH
T182A5AE17B28800DAD01AC3768B56D936EA717C520B34B5CF1651B76A2F7BAE41F3E318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_883cc25338488355d390ad7328e18ea8_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

File Explorer

2026-07-10_883cc25338488355d390ad7328e18ea8_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

.exe 2.1MB

2026-07-10_883cc25338488355d390ad7328e18ea8_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

IMPHASH 1f60bb4f40d5ad8447b07c57e082d2bd
SHA256 48447c7e7affec021086e8c0ad1adf1d16259fe7b3c388692d39f8bf4b540c67
MD5 883cc25338488355d390ad7328e18ea8
SHA1 83d0a17ef60e3ff2b069a0abec8238bbc47f998e
SHA512 a472413e87d745e9f3c6a48d8207672c91708e2f8e30a4103c39fd02ade2d72343af8d7c1cb2d039e0f724a6479e0f54edb8e6022e41a063f9f8a6d801e77883
SSDEEP 49152:9dp+Kc7/y4W/JqA96VvQvtiEIypDmg27RnWGj:9Xxc7lvQl7pD527BWG
TLSH
T182A5AE17B28800DAD01AC3768B56D936EA717C520B34B5CF1651B76A2F7BAE41F3E318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

810704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\cef_win32\build\root\chromium\src\out\Release_GN_x64\cefsimple.exe.pdb

libcef

cef_api_hash cef_base64encode cef_browser_host_create_browser cef_browser_view_create cef_browser_view_get_for_browser cef_command_line_create cef_command_line_get_global cef_enable_highdpi_support cef_execute_process cef_initialize cef_log cef_quit_message_loop cef_run_message_loop cef_shutdown cef_string_list_alloc cef_string_list_append cef_string_list_free cef_string_list_size cef_string_list_value cef_string_map_alloc cef_string_map_append cef_string_map_free cef_string_map_key cef_string_map_size cef_string_map_value cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_free cef_string_multimap_key cef_string_multimap_size cef_string_multimap_value cef_string_userfree_utf8_free cef_string_utf8_clear cef_string_utf8_cmp cef_string_utf8_set cef_string_utf8_to_wide cef_string_wide_clear cef_string_wide_to_utf8 cef_uriencode cef_window_create_top_level

user32

CloseDesktop CloseWindowStation CreateDesktopW CreateWindowStationW GetProcessWindowStation GetThreadDesktop GetUserObjectInformationW SetProcessWindowStation SetWindowTextW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject CloseHandle CompareStringW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateRemoteThread CreateThread DebugBreak DeleteCriticalSection DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileAttributesW GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessHeaps GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OutputDebugStringA PostQueuedCompletionStatus QueryDosDeviceW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadAffinityMask SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory lstrlenA lstrlenW

winmm

timeGetTime

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

63KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

92B

Characteristics

Name

.tls

Size

512B

Virtual Size

297B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

68B

Characteristics

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_883cc25338488355d390ad7328e18ea8_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

libcef

user32

kernel32

winmm

generic