2026-07-31_7c947b704db1e0f73a73fa183af0ed73_cobalt-strike_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_7c947b704db1e0f73a73fa183af0ed73_cobalt-strike_glassworm_icedid_njrat
Size 6.7MB
Sample260731-wc6bdsec23
SHA256 709482aa95daa3104b866f76f3ec97ff2cad7f2607c7d5bbc220421e3ab6b8cf
MD5 7c947b704db1e0f73a73fa183af0ed73
SHA1 aec2fc8a564537ded8403ca600218ca2cc0a8425
SHA512 78b279c76d2eadeb67df8feedd737c85e54a3fafd0cb42d0e73dfed2a5dee1adb754e506f5403e8df999a15ea4940c6e1a9f9be4edf1da2f7bfa30ee358c5570
SSDEEP 49152:1Elegsj61pSag9S0vsZqCMHOvYJ1AdzTKIuBSDz0ybmKJVrTaMywqe488s5nILRo:1bm4/oKIuBPHwqe8LKd5Gj
TLSH
T1E3667B7A25AE419CE07EC1F98F9A5B52C7F37806037269DB02D8956D0E7FDC84A39E01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_7c947b704db1e0f73a73fa183af0ed73_cobalt-strike_glassworm_icedid_njrat

File Explorer

2026-07-31_7c947b704db1e0f73a73fa183af0ed73_cobalt-strike_glassworm_icedid_njrat

.exe 6.7MB

2026-07-31_7c947b704db1e0f73a73fa183af0ed73_cobalt-strike_glassworm_icedid_njrat

IMPHASH c7b22e5f83c3ec5274f76f44ea9929a5
SHA256 709482aa95daa3104b866f76f3ec97ff2cad7f2607c7d5bbc220421e3ab6b8cf
MD5 7c947b704db1e0f73a73fa183af0ed73
SHA1 aec2fc8a564537ded8403ca600218ca2cc0a8425
SHA512 78b279c76d2eadeb67df8feedd737c85e54a3fafd0cb42d0e73dfed2a5dee1adb754e506f5403e8df999a15ea4940c6e1a9f9be4edf1da2f7bfa30ee358c5570
SSDEEP 49152:1Elegsj61pSag9S0vsZqCMHOvYJ1AdzTKIuBSDz0ybmKJVrTaMywqe488s5nILRo:1bm4/oKIuBPHwqe8LKd5Gj
TLSH
T1E3667B7A25AE419CE07EC1F98F9A5B52C7F37806037269DB02D8956D0E7FDC84A39E01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21641

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Project\AsusSystemAnalysis\AsusSystemAnalysisService\x64\AsusSystemAnalysisService\AsusSystemAnalysis.pdb

kernel32

RemoveDirectoryW GetVolumeNameForVolumeMountPointW SetVolumeMountPointW ReleaseMutex CreateMutexW CreateEventW WaitForMultipleObjects InitOnceExecuteOnce SetEvent ResetEvent ExpandEnvironmentStringsW CompareFileTime ReadFile DecodePointer SetHandleInformation CreatePipe HeapDestroy HeapReAlloc HeapSize InitializeCriticalSectionEx TerminateProcess GetProcessId GetSystemDirectoryW FindResourceExW LoadResource LockResource SizeofResource FindResourceW LocalAlloc LocalSize lstrlenW GetPrivateProfileStringA GetPrivateProfileStringW FileTimeToSystemTime SystemTimeToFileTime K32EnumProcesses K32EnumProcessModules K32GetModuleBaseNameW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetFileAttributesExW MoveFileExW SetStdHandle GetFullPathNameW GetFileTime GetFileSize FindVolumeClose FindNextVolumeW FindFirstVolumeW DeleteVolumeMountPointW FormatMessageW GetModuleHandleW SetLastError WriteFile SetFilePointer SetEndOfFile FlushFileBuffers DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCurrentDirectoryA LoadLibraryW GetProcAddress FreeLibrary IsWow64Process2 SetProcessMitigationPolicy QueryDosDeviceW GetFileAttributesA OutputDebugStringW GlobalMemoryStatusEx DeviceIoControl GetVolumeInformationW GetLogicalDriveStringsW GetDiskFreeSpaceExW CreateFileW GetPackagesByPackageFamily GetUserDefaultLCID GetUserDefaultUILanguage GetUserGeoID GetLocaleInfoW MoveFileW ExitProcess FindClose GetStdHandle K32GetModuleFileNameExW LocalFree OpenProcess GetFileAttributesW CreateProcessW WideCharToMultiByte SubmitThreadpoolWork CreateThreadpoolWork CopyFileW FindNextFileW FindFirstFileW DeleteFileW CreateDirectoryW GetCurrentProcessId WTSGetActiveConsoleSessionId GetModuleFileNameW CloseThreadpoolTimer GetWindowsDirectoryW GetExitCodeProcess CloseHandle Sleep GetFirmwareEnvironmentVariableW MultiByteToWideChar SystemTimeToTzSpecificLocalTime SetThreadpoolTimer CreateThreadpoolTimer GetSystemTime CreateThread WaitForSingleObject GetProcessHeap GetCurrentDirectoryW SetCurrentDirectoryW ReadConsoleW SetFilePointerEx GetFileSizeEx RtlUnwind GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect IsThreadAFiber GetTempPathW SetConsoleCtrlHandler GetCurrentThread GetTimeZoneInformation GetCommandLineW GetCommandLineA FindFirstFileExW IsProcessorFeaturePresent GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext DuplicateHandle FreeLibraryAndExitThread ResumeThread ExitThread PeekNamedPipe GetFileInformationByHandle GetDriveTypeW WriteConsoleW GetFileType FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry IsDebuggerPresent GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx RtlCaptureStackBackTrace GetModuleHandleExW CloseThreadpoolWork HeapFree HeapAlloc FreeLibraryWhenCallbackReturns WakeConditionVariable InitOnceComplete InitOnceBeginInitialize RaiseException RtlPcToFileHeader GetLogicalProcessorInformationEx GetExitCodeThread SwitchToThread WaitForSingleObjectEx GetStringTypeW FormatMessageA GetTickCount64 TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared GetSystemTimePreciseAsFileTime QueryPerformanceFrequency InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW GetLogicalDrives WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLastError

user32

UnregisterDeviceNotification UnregisterPowerSettingNotification RegisterPowerSettingNotification RegisterDeviceNotificationW wsprintfW GetWindowThreadProcessId UnregisterClassW MessageBoxW

advapi32

StartServiceCtrlDispatcherW AdjustTokenPrivileges DuplicateTokenEx SetTokenInformation ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam QueryServiceConfigW LookupAccountSidW IsValidSid InitializeAcl GetTokenInformation GetLengthSid GetAclInformation GetAce CopySid AddAce OpenProcessToken RegGetValueW RegSetKeyValueW RegDeleteKeyValueW RegSetValueExW RegQueryInfoKeyW RegNotifyChangeKeyValue RegEnumValueW RegEnumKeyW RegDeleteKeyW RegEnumKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptDecrypt CryptEncrypt CryptImportKey CryptSetKeyParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW CryptAcquireContextA EventWriteTransfer EventSetInformation DeleteService CreateServiceW ControlService EventWriteString EventUnregister EventRegister LookupPrivilegeValueW SetServiceStatus RegisterServiceCtrlHandlerExW CloseServiceHandle ChangeServiceConfig2W SetEntriesInAclW SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid QueryServiceStatus OpenServiceW OpenSCManagerW CreateProcessAsUserW

shell32

ShellExecuteExW SHGetKnownFolderPath

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoTaskMemFree StringFromGUID2 StringFromCLSID CoCreateGuid CoCreateInstance

oleaut32

CreateErrorInfo SetErrorInfo SysFreeString SysAllocString SafeArrayDestroy VariantChangeType GetErrorInfo VariantInit SafeArrayGetElement VariantClear SysStringLen SafeArrayGetUBound SafeArrayGetLBound

rpcrt4

RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW RpcServerListen NdrServerCall2 RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerInqBindings RpcBindingVectorFree RpcStringFreeW NdrServerCallAll RpcServerRegisterIf3 UuidToStringW UuidCreate NdrClientCall3

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiDestroyDeviceInfoList

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-power-base-l1-1-0

GetPwrCapabilities

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptGenRandom BCryptGetProperty BCryptCreateHash BCryptOpenAlgorithmProvider BCryptHashData BCryptDestroyHash BCryptFinishHash

crypt32

CryptImportPublicKeyInfoEx2 CryptDecodeObjectEx

winhttp

WinHttpSendRequest WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCrackUrl

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

shlwapi

PathFileExistsW

winsqlite3

sqlite3_free sqlite3_exec sqlite3_close sqlite3_finalize sqlite3_open sqlite3_bind_text sqlite3_bind_null sqlite3_bind_int sqlite3_bind_double sqlite3_prepare_v2 sqlite3_step sqlite3_errmsg

wininet

InternetGetConnectedState

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

683KB

Virtual Size

683KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

651KB

Virtual Size

666KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_7c947b704db1e0f73a73fa183af0ed73_cobalt-strike_glassworm_icedid_njrat

kernel32

user32

advapi32

shell32

ole32

oleaut32

rpcrt4

iphlpapi

setupapi

wtsapi32

userenv

api-ms-win-security-base-l1-2-2

api-ms-win-power-base-l1-1-0

bcrypt

crypt32

winhttp

version

shlwapi

winsqlite3

wininet

generic