General
- Target 2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 4.2MB
- Sample260801-dpafdadl8v
- SHA256 fb17c29c1c6c6f6971d5f404006d7f51838729ff500bdc5961b2a4ed2e4a7a8e
- MD5 6bb9096ac58e395cd5ce110536ade641
- SHA1 9985bef67ba342bc5740ed78bd524ffe6c4b817e
- SHA512 c341640b4b4e7f4ff67f53eecbc14d7f9cc54e1a7f873a1d3201c8a284304152b3fc67df97f27124decc84ec20e271b6c987d91f69e80fca3b57c55962c784c6
- SSDEEP 49152:xHPjQGCiLS4zuBUgDJYk5SUYvJjw0wyiE5oqrHLJO1qKL+XJLA5Z/h92e9G6svtI:dS4zwUI5o9NfiEoqDL415gU2eQP1I
- TLSH T1CA16E1A299C0E05CC763C2704D1B71019619F6FB27F875CAAADE456DAF11F818E37B28
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 4.2MB
- SHA256 fb17c29c1c6c6f6971d5f404006d7f51838729ff500bdc5961b2a4ed2e4a7a8e
- MD5 6bb9096ac58e395cd5ce110536ade641
- SHA1 9985bef67ba342bc5740ed78bd524ffe6c4b817e
- SHA512 c341640b4b4e7f4ff67f53eecbc14d7f9cc54e1a7f873a1d3201c8a284304152b3fc67df97f27124decc84ec20e271b6c987d91f69e80fca3b57c55962c784c6
- SSDEEP 49152:xHPjQGCiLS4zuBUgDJYk5SUYvJjw0wyiE5oqrHLJO1qKL+XJLA5Z/h92e9G6svtI:dS4zwUI5o9NfiEoqDL415gU2eQP1I
- TLSH T1CA16E1A299C0E05CC763C2704D1B71019619F6FB27F875CAAADE456DAF11F818E37B28
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks whether UAC is enabled
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Suspicious use of NtSetInformationThreadHideFromDebugger