2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 4.2MB
Sample260801-dpafdadl8v
SHA256 fb17c29c1c6c6f6971d5f404006d7f51838729ff500bdc5961b2a4ed2e4a7a8e
MD5 6bb9096ac58e395cd5ce110536ade641
SHA1 9985bef67ba342bc5740ed78bd524ffe6c4b817e
SHA512 c341640b4b4e7f4ff67f53eecbc14d7f9cc54e1a7f873a1d3201c8a284304152b3fc67df97f27124decc84ec20e271b6c987d91f69e80fca3b57c55962c784c6
SSDEEP 49152:xHPjQGCiLS4zuBUgDJYk5SUYvJjw0wyiE5oqrHLJO1qKL+XJLA5Z/h92e9G6svtI:dS4zwUI5o9NfiEoqDL415gU2eQP1I
TLSH
T1CA16E1A299C0E05CC763C2704D1B71019619F6FB27F875CAAADE456DAF11F818E37B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 4.2MB

2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH a51834a2d1c1940db9861f20d18b045c
SHA256 fb17c29c1c6c6f6971d5f404006d7f51838729ff500bdc5961b2a4ed2e4a7a8e
MD5 6bb9096ac58e395cd5ce110536ade641
SHA1 9985bef67ba342bc5740ed78bd524ffe6c4b817e
SHA512 c341640b4b4e7f4ff67f53eecbc14d7f9cc54e1a7f873a1d3201c8a284304152b3fc67df97f27124decc84ec20e271b6c987d91f69e80fca3b57c55962c784c6
SSDEEP 49152:xHPjQGCiLS4zuBUgDJYk5SUYvJjw0wyiE5oqrHLJO1qKL+XJLA5Z/h92e9G6svtI:dS4zwUI5o9NfiEoqDL415gU2eQP1I
TLSH
T1CA16E1A299C0E05CC763C2704D1B71019619F6FB27F875CAAADE456DAF11F818E37B28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

237536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueA RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash EventRegister EventSetInformation EventWriteTransfer EventUnregister RegGetValueW

user32

IsWindowVisible LoadIconW LoadCursorA EnumWindows FindWindowW ScreenToClient MessageBoxW GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA PostMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow GetClientRect SetWindowPos SetFocus keybd_event ReleaseCapture SetTimer KillTimer GetSystemMetrics UpdateWindow SetForegroundWindow BeginPaint EndPaint InvalidateRect GetWindowTextW

shell32

ShellExecuteExW SHEmptyRecycleBinW ShellExecuteW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoUninitialize

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

dwmapi

DwmSetWindowAttribute

urlmon

URLDownloadToFileW

gdiplus

GdipDeletePath GdipAlloc GdipSetStringFormatAlign GdipDeleteStringFormat GdipFree GdiplusStartup GdipCreatePath GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipAddPathEllipseI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateLineBrush GdipCreatePen1 GdipDeletePen GdipSetPenStartCap GdipSetPenEndCap GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipDrawLine GdipDrawRectangleI GdipDrawEllipseI GdipFillRectangleI GdipFillEllipseI GdipDrawImageRectI GdipSetClipPath GdipResetClip GdipCreateFontFamilyFromName GdiplusShutdown

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpQueryHeaders WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

kernel32

GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetCommandLineW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetFileType FreeLibraryAndExitThread ExitThread CreateThread IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetFileSizeEx RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx FormatMessageA LocalFree GetSystemTimePreciseAsFileTime LoadLibraryExW OutputDebugStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetProcessMemoryInfo K32EmptyWorkingSet K32GetModuleFileNameExW GetStdHandle GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileSize ReadFile WriteFile GetTempPathW IsDebuggerPresent DebugBreak OutputDebugStringW CheckRemoteDebuggerPresent CloseHandle SetHandleInformation GetLastError SetLastError CreatePipe QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateMutexW OpenSemaphoreW CreateMutexExW CreateSemaphoreExW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess GetExitCodeProcess GetCurrentThread GetCurrentThreadId CreateProcessW GetThreadContext OpenProcess GetSystemTimes GlobalMemoryStatusEx GetTickCount GetTickCount64 GetSystemDirectoryW ReadProcessMemory FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GlobalFree FormatMessageW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow RtlUnwind

Name

.text

Size

396KB

Virtual Size

395KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

advapi32

user32

shell32

ole32

gdi32

dwmapi

urlmon

gdiplus

winhttp

kernel32

generic