General
- Target 2026-07-23_119564163378bcd29f10fd5837db1de7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 15.9MB
- Sample260723-r7bm2sen3t
- SHA256 1324fc20655f84954ae88bfb8d468cfeaf141cb479186258953d89696d59176c
- MD5 119564163378bcd29f10fd5837db1de7
- SHA1 d5d2bd8a4d6cffdf08fceaa1dcf69642b8daf8bb
- SHA512 3df801cd91a66a8e51fd919d5da6c6542d5ffebf1702f98d7b7c8655bc97a64da6714e42be81cf4a9f9698001a540622ce44042de39b758bdfc20b99b5bdf08f
- SSDEEP 393216:3B7w5i8pPCYB7w5i8pPCFkf+t11P/8pPt:3B7D8pPCYB7D8pPCFkfCX8pP
- TLSH T1EAF6AE06B69411A8E173923D8DDB9A6BEA723C0503205BCB07D057DD1F6BBD90ABF721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-23_119564163378bcd29f10fd5837db1de7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_119564163378bcd29f10fd5837db1de7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_119564163378bcd29f10fd5837db1de7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 15.9MB
- SHA256 1324fc20655f84954ae88bfb8d468cfeaf141cb479186258953d89696d59176c
- MD5 119564163378bcd29f10fd5837db1de7
- SHA1 d5d2bd8a4d6cffdf08fceaa1dcf69642b8daf8bb
- SHA512 3df801cd91a66a8e51fd919d5da6c6542d5ffebf1702f98d7b7c8655bc97a64da6714e42be81cf4a9f9698001a540622ce44042de39b758bdfc20b99b5bdf08f
- SSDEEP 393216:3B7w5i8pPCYB7w5i8pPCFkf+t11P/8pPt:3B7D8pPCYB7D8pPCFkfCX8pP
- TLSH T1EAF6AE06B69411A8E173923D8DDB9A6BEA723C0503205BCB07D057DD1F6BBD90ABF721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Suspicious use of NtSetInformationThreadHideFromDebugger