2026-07-11_691d56d8fc18286913b825bdbc10234e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_691d56d8fc18286913b825bdbc10234e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 884KB
Sample260711-m2fmlagw8p
SHA256 385c9433998ad23f8c46ba4857a25caa0e28c6cd7f12c6adbe2ab7352290b279
MD5 691d56d8fc18286913b825bdbc10234e
SHA1 4541678c9534954357dbe45770d53e342e6f53cc
SHA512 8b60a1a34a16d9e8d075a62e248d0290f6f974d3629c4ebbb0c3b3c1123481175648cb9ba9320ddb9dd68e9aeb16acbf883ba79b91cfaca3acae2a3ad93418c5
SSDEEP 12288:wydjHlGt1wDM6JGaStmeC6ARYKikbqXu3J5yDLj+YbjQZV8V:5MuM6waCC6nKikbqXu3J5o+SjQZV8V
TLSH
T1FF155B266A6800BDD1B7C1B88E665903D671784B0330ADDF339C59A63F276E84B7EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_691d56d8fc18286913b825bdbc10234e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-07-11_691d56d8fc18286913b825bdbc10234e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 884KB

2026-07-11_691d56d8fc18286913b825bdbc10234e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 1ce83213b17fe4ba7a9435b34c5f9ffd
SHA256 385c9433998ad23f8c46ba4857a25caa0e28c6cd7f12c6adbe2ab7352290b279
MD5 691d56d8fc18286913b825bdbc10234e
SHA1 4541678c9534954357dbe45770d53e342e6f53cc
SHA512 8b60a1a34a16d9e8d075a62e248d0290f6f974d3629c4ebbb0c3b3c1123481175648cb9ba9320ddb9dd68e9aeb16acbf883ba79b91cfaca3acae2a3ad93418c5
SSDEEP 12288:wydjHlGt1wDM6JGaStmeC6ARYKikbqXu3J5yDLj+YbjQZV8V:5MuM6waCC6nKikbqXu3J5o+SjQZV8V
TLSH
T1FF155B266A6800BDD1B7C1B88E665903D671784B0330ADDF339C59A63F276E84B7EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

465792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpWriteData WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpCrackUrl WinHttpQueryDataAvailable

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptOpenAlgorithmProvider BCryptFinishHash BCryptHashData BCryptDestroyHash

shlwapi

PathFileExistsA

ws2_32

inet_pton WSAStartup send socket connect recv htons WSACleanup setsockopt ntohs getsockname inet_addr listen bind accept __WSAFDIsSet closesocket select

kernel32

HeapReAlloc GetFileAttributesExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetFileAttributesExA MultiByteToWideChar GetLastError WideCharToMultiByte Process32First FindFirstFileA TerminateProcess FindNextFileA GetEnvironmentVariableA FindClose OpenProcess CreateToolhelp32Snapshot GetFileAttributesA Process32Next CloseHandle ReadFile GetFileSizeEx VirtualFree VirtualAlloc GetModuleHandleA Sleep QueryFullProcessImageNameA CreateFileA GetProcAddress GetConsoleMode FindFirstFileExW FindNextFileW GetLogicalDriveStringsW LocalFree GetDriveTypeW UnmapViewOfFile SetStdHandle MapViewOfFile WriteFile GetTempPathA DeleteFileA GetComputerNameA GetProcessId WaitForSingleObject RemoveDirectoryA CreateProcessA CreateDirectoryA SetFilePointer GetFileSize GetCurrentProcess GetDriveTypeA GetVolumeInformationA GetLocaleInfoA GetTimeZoneInformation GetTickCount64 GetNativeSystemInfo GetSystemInfo GetLogicalDriveStringsA GlobalMemoryStatusEx GetDiskFreeSpaceExA WaitForMultipleObjects CreateThread GetTickCount GetExitCodeProcess GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW ExitProcess IsProcessorFeaturePresent SetFilePointerEx FlushFileBuffers ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW GetFileType CreateFileMappingA GetConsoleOutputCP FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize WriteConsoleW ReadProcessMemory CreateFileW SetEndOfFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree RaiseException WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue

user32

ReleaseDC GetSystemMetrics GetDC wsprintfW GetKeyboardLayoutList MonitorFromPoint SystemParametersInfoW

advapi32

GetUserNameA CredFree RegOpenKeyExA RegQueryValueExA RegCloseKey GetTokenInformation OpenProcessToken CredReadA RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

shell32

SHGetFolderPathA

iphlpapi

GetAdaptersAddresses

gdi32

DeleteObject GetDIBits SelectObject CreateCompatibleBitmap BitBlt DeleteDC CreateCompatibleDC

rstrtmgr

RmStartSession RmRegisterResources RmGetList RmEndSession

ntdll

RtlPcToFileHeader

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

Name

.text

Size

659KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

179KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

16KB

Virtual Size

408KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_691d56d8fc18286913b825bdbc10234e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

winhttp

crypt32

bcrypt

shlwapi

ws2_32

kernel32

user32

advapi32

shell32

iphlpapi

gdi32

rstrtmgr

ntdll

api-ms-win-shcore-scaling-l1-1-1

generic