General
- Target 2026-07-28_fd62ba880ed871a994852cfbe29431a7_cobalt-strike_ghostweaver_glassworm_icedid_lockbit_satacom
- Size 8.5MB
- Sample260729-aa7wjs1wbs
- SHA256 98c80a7872df6a57bb8c8fc5127dc67373572d4e689b9153f03d8f41fcd0acec
- MD5 fd62ba880ed871a994852cfbe29431a7
- SHA1 2629e9632864021de534fb6fbd197cd5a87c6041
- SHA512 653373dfabf604fce7c43d00a1a868fe391f32425eaf9cdb19ccd40a8f59c82cf4cdc0691a83b6319e5cca78c6d7af26b849f10a6159803bc09799ba24b72d50
- SSDEEP 49152:xwKItB37CAji37mRD/aytFqMC61+CRDjl+3hBj8xsBAbt6Tu6/i2p+7GC/iqc1Tg:rK08qM15MThMClPVNRxOpq3xDgYejJ
- TLSH T14C967C45EF9485E2D51BC234CA5BB632EBB0BC506A21C60F1635F70E1F73AA0CE6E525
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-28_fd62ba880ed871a994852cfbe29431a7_cobalt-strike_ghostweaver_glassworm_icedid_lockbit_satacom.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_fd62ba880ed871a994852cfbe29431a7_cobalt-strike_ghostweaver_glassworm_icedid_lockbit_satacom.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_fd62ba880ed871a994852cfbe29431a7_cobalt-strike_ghostweaver_glassworm_icedid_lockbit_satacom
- Size 8.5MB
- SHA256 98c80a7872df6a57bb8c8fc5127dc67373572d4e689b9153f03d8f41fcd0acec
- MD5 fd62ba880ed871a994852cfbe29431a7
- SHA1 2629e9632864021de534fb6fbd197cd5a87c6041
- SHA512 653373dfabf604fce7c43d00a1a868fe391f32425eaf9cdb19ccd40a8f59c82cf4cdc0691a83b6319e5cca78c6d7af26b849f10a6159803bc09799ba24b72d50
- SSDEEP 49152:xwKItB37CAji37mRD/aytFqMC61+CRDjl+3hBj8xsBAbt6Tu6/i2p+7GC/iqc1Tg:rK08qM15MThMClPVNRxOpq3xDgYejJ
- TLSH T14C967C45EF9485E2D51BC234CA5BB632EBB0BC506A21C60F1635F70E1F73AA0CE6E525
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Windows security bypass
-
Windows security modification
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger