2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 4.1MB
Sample260730-qyt8csszgx
SHA256 42e93cefc36e534d2f3303631319d7547e98e00a005df250d3aaeed1a954dc77
MD5 7797547ad692829e91acadab30fd9d16
SHA1 a59f061893dad55fca2070913751f7da9edd8d61
SHA512 7534b4f9001ca70351460f390cd2caf72837ccc75147f0f40ea159d632de64d7a9833032e370a37e9c327ea0911b060b374fdfa346dd0de6afc71dd12e91745a
SSDEEP 49152:f49l6dE/KrzuBUgDJYk5SUYvJjwwwyiE5oqrHLJO1qRL+X4LA5Z/h92e9G6svtcT:02drzwUI5o9NniEoqDL412gF2eQP1I
TLSH
T15116E1A299C0E15CC663C2704D1B71019619B2FB27F8B5CABADE456DAF11F81CD37B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 4.1MB

2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 72f4dd3b3a01bcb1bd2288518f06cfbf
SHA256 42e93cefc36e534d2f3303631319d7547e98e00a005df250d3aaeed1a954dc77
MD5 7797547ad692829e91acadab30fd9d16
SHA1 a59f061893dad55fca2070913751f7da9edd8d61
SHA512 7534b4f9001ca70351460f390cd2caf72837ccc75147f0f40ea159d632de64d7a9833032e370a37e9c327ea0911b060b374fdfa346dd0de6afc71dd12e91745a
SSDEEP 49152:f49l6dE/KrzuBUgDJYk5SUYvJjwwwyiE5oqrHLJO1qRL+X4LA5Z/h92e9G6svtcT:02drzwUI5o9NniEoqDL412gF2eQP1I
TLSH
T15116E1A299C0E15CC663C2704D1B71019619B2FB27F8B5CABADE456DAF11F81CD37B28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

223712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueA RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash EventRegister EventSetInformation EventWriteTransfer EventUnregister RegGetValueW

user32

SetFocus LoadIconW LoadCursorA EnumWindows FindWindowW ScreenToClient GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetWindowPos MessageBoxW IsWindowVisible keybd_event ReleaseCapture SetTimer KillTimer GetSystemMetrics UpdateWindow SetForegroundWindow BeginPaint EndPaint InvalidateRect GetWindowTextW GetClientRect

shell32

ShellExecuteExW SHEmptyRecycleBinW ShellExecuteW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoUninitialize

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

dwmapi

DwmSetWindowAttribute

urlmon

URLDownloadToFileW

gdiplus

GdiplusStartup GdipDeletePath GdipAlloc GdipSetStringFormatAlign GdipDeleteStringFormat GdipFree GdipCreatePath GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipAddPathEllipseI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateLineBrush GdipCreatePen1 GdipDeletePen GdipSetPenStartCap GdipSetPenEndCap GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipDrawLine GdipDrawRectangleI GdipDrawEllipseI GdipFillRectangleI GdipFillEllipseI GdipDrawImageRectI GdipSetClipPath GdipResetClip GdipCreateFontFamilyFromName GdiplusShutdown

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

kernel32

GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetCommandLineW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetFileType ExitProcess FreeLibraryAndExitThread ExitThread CreateThread IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetFileSizeEx FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx FormatMessageA LocalFree GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryExW OutputDebugStringA GetStdHandle GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileSize ReadFile WriteFile GetTempPathW IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle SetHandleInformation GetLastError SetLastError CreatePipe HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateMutexW OpenSemaphoreW CreateMutexExW CreateSemaphoreExW Sleep GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetCurrentThread GetCurrentThreadId CreateProcessW OpenProcess GetSystemTimes GlobalMemoryStatusEx GetSystemDirectoryW FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GlobalFree FormatMessageW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow K32EmptyWorkingSet K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlUnwind

Name

.text

Size

382KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

advapi32

user32

shell32

ole32

gdi32

dwmapi

urlmon

gdiplus

winhttp

kernel32

generic