2026-07-11_0cb5505972a5561d473784f3355d3a17_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_0cb5505972a5561d473784f3355d3a17_cobalt-strike_glassworm_icedid_njrat_satacom
Size 5.5MB
Sample260711-hm7ejsdv3l
SHA256 2150f1ce79d73cd83d1466c70100a6413d22a62f14b7e9457d6e1834180220c5
MD5 0cb5505972a5561d473784f3355d3a17
SHA1 4364307702e8ebc820c1c2258e29ae40c7bc3947
SHA512 7029221a5ba6f8de4151b70edd894de0c8f1d022b27a24bb3aa623c40965018b1b4e343d53e4277e64d9ec5cb46878c77399bc069f9b30c715af96aa1f374ea2
SSDEEP 49152:1o1m/+lwZ5rLitT23rYFahm0sRHkIi2YIZly/d1dJCfhIzGyTckqhh:XhCTwLaT
TLSH
T1D1466B637A5004D8E5118B764491D6F2EAF075600FB34AEB35BAF49D2F226D00E7BE93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_0cb5505972a5561d473784f3355d3a17_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-07-11_0cb5505972a5561d473784f3355d3a17_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 5.5MB

2026-07-11_0cb5505972a5561d473784f3355d3a17_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH 602c3c895a9f3e7283a97c67cf06d522
SHA256 2150f1ce79d73cd83d1466c70100a6413d22a62f14b7e9457d6e1834180220c5
MD5 0cb5505972a5561d473784f3355d3a17
SHA1 4364307702e8ebc820c1c2258e29ae40c7bc3947
SHA512 7029221a5ba6f8de4151b70edd894de0c8f1d022b27a24bb3aa623c40965018b1b4e343d53e4277e64d9ec5cb46878c77399bc069f9b30c715af96aa1f374ea2
SSDEEP 49152:1o1m/+lwZ5rLitT23rYFahm0sRHkIi2YIZly/d1dJCfhIzGyTckqhh:XhCTwLaT
TLSH
T1D1466B637A5004D8E5118B764491D6F2EAF075600FB34AEB35BAF49D2F226D00E7BE93
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1052320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\brad\source\repos\doomretro\msvc\Release\doomretro.pdb

sdl2

SDL_SetMainReady SDL_wcslen SDL_memcpy SDL_GetPerformanceCounter SDL_SetWindowSize SDL_SetWindowPosition SDL_StopTextInput SDL_free SDL_SetClipboardText SDL_GetClipboardText SDL_StartTextInput SDL_Init SDL_ShowSimpleMessageBox SDL_GetWindowWMInfo SDL_GameControllerHasRumble SDL_GameControllerHasLED SDL_NumJoysticks SDL_GameControllerRumble SDL_JoystickInstanceID SDL_SetHintWithPriority SDL_GameControllerClose SDL_IsGameController SDL_GameControllerOpen SDL_GameControllerGetTouchpadFinger SDL_GameControllerGetNumTouchpads SDL_GameControllerName SDL_GameControllerGetType SDL_EventState SDL_GameControllerGetJoystick SDL_GameControllerGetButton SDL_GameControllerSetLED SDL_RWclose SDL_GameControllerGetAxis SDL_RWFromMem SDL_setenv SDL_FreeWAV SDL_LoadWAV_RW SDL_GetSystemRAM SDL_GetCPUCount SDL_Quit SDL_Delay SDL_GetTicks64 SDL_GetDisplayMode SDL_SetSurfacePalette SDL_GetKeyboardState SDL_RaiseWindow SDL_GetNumDisplayModes SDL_RenderCopy SDL_RenderClear SDL_SetRenderTarget SDL_UpdateTexture SDL_PumpEvents SDL_GetDisplayBounds SDL_GetWindowPixelFormat SDL_GetWindowDisplayIndex SDL_GetNumVideoDisplays SDL_DestroyWindow SDL_GetError SDL_ResetKeyboard SDL_GetRenderer SDL_FreeSurface SDL_RenderReadPixels SDL_ShowMessageBox SDL_GetWindowDisplayMode SDL_iconv_string SDL_SetRelativeMouseMode SDL_SetSurfaceAlphaMod SDL_GetRendererInfo SDL_ShowCursor SDL_GetWindowID SDL_GetScancodeFromKey SDL_CreateTexture SDL_GetDisplayName SDL_strlen SDL_GetMouseState SDL_GL_GetAttribute SDL_WarpMouseInWindow SDL_SetSurfaceBlendMode SDL_PollEvent SDL_GL_SetSwapInterval SDL_CreateRGBSurface SDL_RenderSetLogicalSize SDL_PixelFormatEnumToMasks SDL_CreateRenderer SDL_RenderPresent SDL_GetVersion SDL_CreateWindow SDL_SetWindowTitle SDL_FillRect SDL_AllocPalette SDL_SetWindowFullscreen SDL_GetCurrentAudioDriver SDL_RWseek SDL_RWread SDL_GetModState SDL_GetWindowSize SDL_GetRelativeMouseState SDL_IsTextInputActive SDL_LowerBlit SDL_GetPerformanceFrequency SDL_SetRenderDrawColor SDL_SetPaletteColors

sdl2_mixer

Mix_VolumeMusic Mix_QuerySpec Mix_GetMusicType Mix_HaltMusic Mix_PlayMusic Mix_ResumeMusic Mix_OpenAudioDevice Mix_LoadMUS_RW Mix_FreeMusic Mix_Linked_Version Mix_LoadMUS Mix_HaltChannel Mix_PlayChannel Mix_Playing Mix_CloseAudio Mix_AllocateChannels Mix_SetPanning Mix_PauseMusic

sdl2_image

IMG_SavePNG IMG_Linked_Version

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData

kernel32

GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW OutputDebugStringW GetConsoleOutputCP FlushFileBuffers GetFileSizeEx SetStdHandle GetFullPathNameW GetCurrentDirectoryW MoveFileExW DeleteFileW ReadConsoleW GetConsoleMode SetFilePointerEx GetTimeZoneInformation LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetTempPathW HeapReAlloc HeapFree HeapAlloc GetProcessHeap IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteFile WriteConsoleW GetModuleFileNameW GetStdHandle GetModuleHandleExW FreeLibrary TerminateProcess ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW CreateFileW ReadFile RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter CreateDirectoryW SetEndOfFile HeapSize LocalFree UnhandledExceptionFilter FindClose RtlUnwind FindNextFileA FindFirstFileA GetProcessId CreateEventA ResetEvent CreateThread SetEvent WaitForSingleObject SetThreadPriority WaitForMultipleObjects SetUnhandledExceptionFilter GetCurrentProcessId GetCurrentThread CreateFileA GetCurrentThreadId GetModuleFileNameA GetProcAddress CloseHandle GetLastError GetModuleHandleA ReleaseMutex CreateMutexA GetCurrentProcess GetLocaleInfoA WideCharToMultiByte MultiByteToWideChar

user32

RegisterHotKey UnregisterHotKey SetForegroundWindow GetWindowThreadProcessId GetWindow IsWindowVisible WaitForInputIdle GetActiveWindow ShowWindow AttachThreadInput EnumWindows BringWindowToTop keybd_event GetKeyState LoadCursorA GetSystemMetrics FindWindowA CallWindowProcA SetClassLongPtrA SetCursor LoadIconA SystemParametersInfoA SetWindowLongPtrA DestroyIcon

comdlg32

GetOpenFileNameA

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

CommandLineToArgvW ShellExecuteExA ShellExecuteA

winmm

midiOutUnprepareHeader midiStreamStop midiStreamOpen midiStreamProperty midiStreamPause midiStreamClose midiStreamOut midiOutShortMsg midiStreamRestart midiOutGetErrorTextA midiOutReset midiOutGetDevCapsA midiOutPrepareHeader

dbghelp

SymCleanup SymGetModuleBase64 SymGetModuleInfo64 SymGetLineFromAddr64 SymFunctionTableAccess64 MiniDumpWriteDump SymInitialize StackWalk64 SymSetOptions SymFromAddr

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

350KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.7MB

Virtual Size

152.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_0cb5505972a5561d473784f3355d3a17_cobalt-strike_glassworm_icedid_njrat_satacom

sdl2

sdl2_mixer

sdl2_image

winhttp

kernel32

user32

comdlg32

advapi32

shell32

winmm

dbghelp

generic