General
- Target 2026-07-28_6cc2c7e011fe6db16b5256b61abc20ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- Sample260728-p6qdpshr7x
- SHA256 3a29874d13b34162b4e5a35cddbfaee07ef36bc571c679f030e907fd08fad281
- MD5 6cc2c7e011fe6db16b5256b61abc20ed
- SHA1 5c851618aca076cdba76495afbfaac65682ead7e
- SHA512 66b1a3e29d0d28d33db52ef8fb9f32aa5edb79f13201b61eae5633083289502d41850b5fa930f38cb21f63ca46422b8d227428cde6861201a9e628040e529053
- SSDEEP 98304:0SpbOrf4DgU6vBELOnTWPBx6wRcQKiKkKURgyLjR+gEiWyssUhVHU023W:3ZOr1WoWnRSQRpEqsFhZp4W
- TLSH T1C6A67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_6cc2c7e011fe6db16b5256b61abc20ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_6cc2c7e011fe6db16b5256b61abc20ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- SHA256 3a29874d13b34162b4e5a35cddbfaee07ef36bc571c679f030e907fd08fad281
- MD5 6cc2c7e011fe6db16b5256b61abc20ed
- SHA1 5c851618aca076cdba76495afbfaac65682ead7e
- SHA512 66b1a3e29d0d28d33db52ef8fb9f32aa5edb79f13201b61eae5633083289502d41850b5fa930f38cb21f63ca46422b8d227428cde6861201a9e628040e529053
- SSDEEP 98304:0SpbOrf4DgU6vBELOnTWPBx6wRcQKiKkKURgyLjR+gEiWyssUhVHU023W:3ZOr1WoWnRSQRpEqsFhZp4W
- TLSH T1C6A67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1