2026-07-27_d0f179c1dd83316e5a605c93a5bd286e_cobalt-strike_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_d0f179c1dd83316e5a605c93a5bd286e_cobalt-strike_glassworm_icedid_njrat
Size 16.3MB
Sample260727-rhv1dsvsbv
SHA256 32f6471b3ed64f5dde535e22c4919118228a3f491ee6e05d1e2138332e97589d
MD5 d0f179c1dd83316e5a605c93a5bd286e
SHA1 509ee546b902b89ea6a14d78599f77538cf90569
SHA512 67aa5ec35f576bf9e6de260d0c660e01fc8efadb687421279c64d7f9234f218bbe5c9e21294bbed58e0e4a86bb5f018d21f6b61c39620f08ca0f81668b2302a2
SSDEEP 393216:74BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:BBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T116077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_d0f179c1dd83316e5a605c93a5bd286e_cobalt-strike_glassworm_icedid_njrat

File Explorer

2026-07-27_d0f179c1dd83316e5a605c93a5bd286e_cobalt-strike_glassworm_icedid_njrat

.exe 16.3MB

2026-07-27_d0f179c1dd83316e5a605c93a5bd286e_cobalt-strike_glassworm_icedid_njrat

IMPHASH 3f8598ffe56eda61b40e2aa98e11b949
SHA256 32f6471b3ed64f5dde535e22c4919118228a3f491ee6e05d1e2138332e97589d
MD5 d0f179c1dd83316e5a605c93a5bd286e
SHA1 509ee546b902b89ea6a14d78599f77538cf90569
SHA512 67aa5ec35f576bf9e6de260d0c660e01fc8efadb687421279c64d7f9234f218bbe5c9e21294bbed58e0e4a86bb5f018d21f6b61c39620f08ca0f81668b2302a2
SSDEEP 393216:74BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:BBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T116077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16973824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dbghelp

StackWalk64 SymInitialize SymGetOptions SymSetOptions SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSendRequest WinHttpSetCredentials WinHttpQueryHeaders WinHttpOpenRequest

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA RegSetKeyValueW SystemFunction036

kernel32

GetOEMCP GetACP IsValidCodePage FlushFileBuffers HeapQueryInformation HeapSize GetCurrentDirectoryW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetCurrentDirectoryW GetNamedPipeInfo GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileAttributesW LocalFree MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent VirtualProtect GetCurrentThreadStackLimits InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce CreateDirectoryW DeleteFileW RemoveDirectoryW GetLastError GetModuleFileNameW GetCurrentProcess TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 CloseHandle GetCurrentProcessId VirtualQuery FreeLibrary LoadLibraryExW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCurrentThread GetThreadId GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadLibraryA RaiseException DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetModuleHandleA GetModuleFileNameA RtlCaptureStackBackTrace CreateFileW LockFileEx SetEndOfFile UnlockFileEx CreateProcessW GetStdHandle GetFileType SetUnhandledExceptionFilter AddVectoredExceptionHandler SetEvent SleepEx CreateEventW Sleep GetCurrentThreadId GetExitCodeThread FlushInstructionCache OpenProcess GetVersion VirtualAllocEx VirtualProtectEx WriteProcessMemory WerRegisterRuntimeExceptionModule RemoveVectoredExceptionHandler GetFileSizeEx ReadFile SetFilePointerEx WriteFile RtlUnwind FindFirstFileExW GetFileTime MoveFileExW LoadLibraryW FormatMessageA DuplicateHandle GetSystemInfo VirtualQueryEx ReadProcessMemory SetLastError SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime FormatMessageW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection IsValidLocale GetLocaleInfoW LCMapStringW VirtualAlloc VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable WaitForSingleObjectEx SwitchToThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetSystemTimePreciseAsFileTime InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW GetStartupInfoW InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetDriveTypeW GetFullPathNameW IsProcessorFeaturePresent GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetCommandLineA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapAlloc HeapFree GetTempPathW IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW

shell32

CommandLineToArgvW

Name

.text

Size

13.5MB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

622KB

Virtual Size

621KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_d0f179c1dd83316e5a605c93a5bd286e_cobalt-strike_glassworm_icedid_njrat

dbghelp

version

winhttp

advapi32

kernel32

shell32

generic