2026-08-01_89cabe75fa58df0e6674689a47413ae7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_89cabe75fa58df0e6674689a47413ae7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar
Size 11.6MB
Sample260801-txd2jade33
SHA256 7b887258932afa44e31b5a1b154ca8faf83b22b6a7858da88befb9f55d687b3a
MD5 89cabe75fa58df0e6674689a47413ae7
SHA1 736e99f173cda8969e72ff12951f427177257620
SHA512 239bf276e03757eb832a8e5ec1ccddbbe58b171ab76d6d60c535f8a83bace69b5e8f57f59b2efc05400f6bd8af6a74b90653483dd18d9d35bbebefd37d388dd2
SSDEEP 98304:CHpcOomSW1Fe6wOHcRlS6I0m/kgpODmYZxDkNXZe5RpD527BWG:CHpcAf1A6we8JmX05nVQBWG
TLSH
T1E8C6181F276944AEC4B6F27DE5021F80F13F7056075296DB079102F56DAEAEC8FBA620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_89cabe75fa58df0e6674689a47413ae7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-01_89cabe75fa58df0e6674689a47413ae7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 11.6MB

2026-08-01_89cabe75fa58df0e6674689a47413ae7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH 82517fbad97df71697b4008f89940efa
SHA256 7b887258932afa44e31b5a1b154ca8faf83b22b6a7858da88befb9f55d687b3a
MD5 89cabe75fa58df0e6674689a47413ae7
SHA1 736e99f173cda8969e72ff12951f427177257620
SHA512 239bf276e03757eb832a8e5ec1ccddbbe58b171ab76d6d60c535f8a83bace69b5e8f57f59b2efc05400f6bd8af6a74b90653483dd18d9d35bbebefd37d388dd2
SSDEEP 98304:CHpcOomSW1Fe6wOHcRlS6I0m/kgpODmYZxDkNXZe5RpD527BWG:CHpcAf1A6we8JmX05nVQBWG
TLSH
T1E8C6181F276944AEC4B6F27DE5021F80F13F7056075296DB079102F56DAEAEC8FBA620
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5218544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\jenkins\workspace\uto-update_release_PDFY24OCT_1.0\target\Windows\x64\symbols\Release\AdskAccessServiceHost.pdb

authz

AuthzInitializeResourceManager AuthzFreeResourceManager AuthzInitializeContextFromSid AuthzFreeContext AuthzAccessCheck

version

GetFileVersionInfoSizeW GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoW VerQueryValueW

msi

ord217 ord173

shlwapi

PathUnquoteSpacesW PathIsUNCW PathRemoveFileSpecW PathFileExistsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken WTSEnumerateSessionsW WTSCloseServer WTSOpenServerW

secur32

LsaFreeReturnBuffer LsaEnumerateLogonSessions LsaGetLogonSessionData

kernel32

CreateThread SetConsoleCtrlHandler GetExitCodeProcess MultiByteToWideChar GetProcAddress LoadLibraryA GetModuleFileNameA GetSystemTime SystemTimeToFileTime AreFileApisANSI CreateFileA ReadFile WriteFile GetSystemDirectoryW SetHandleInformation SetUnhandledExceptionFilter CreatePipe GetProcessTimes GetCurrentProcess TerminateProcess GetCurrentThreadId TlsAlloc TlsFree CreateProcessW FindResourceExW LoadResource LockResource SizeofResource FindResourceW LocalAlloc GetSystemInfo GetModuleHandleW GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessA LoadLibraryExW ProcessIdToSessionId OpenProcess AddDllDirectory LoadLibraryW GlobalAlloc GlobalFree lstrcpyW QueryFullProcessImageNameW SetDllDirectoryW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleFileNameExW CreateFileW GetFileAttributesExW GetFileSize GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared CreateEventA WaitForSingleObjectEx CreateMutexA ReleaseMutex GetEnvironmentStrings FreeEnvironmentStringsA PostQueuedCompletionStatus OpenMutexA QueryPerformanceCounter QueryPerformanceFrequency ResetEvent ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer CreateEventW ResumeThread TlsGetValue TlsSetValue GetLogicalProcessorInformation GetModuleHandleA CreateWaitableTimerA GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FlushFileBuffers GetFileAttributesW GetFileInformationByHandle GetFileTime GetFullPathNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime DeviceIoControl GetWindowsDirectoryW CreateDirectoryExW CopyFileExW MoveFileExW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemTimeAsFileTime WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoA IsValidCodePage IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW ConnectNamedPipe DisconnectNamedPipe GetOverlappedResult CancelIo CreateNamedPipeA WaitNamedPipeA LockFileEx UnlockFileEx PeekNamedPipe SetLastError GetCurrentThread GetThreadTimes RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead InitializeCriticalSectionAndSpinCount OutputDebugStringW IsDebuggerPresent GetCPInfo CompareStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetTickCount64 GetCurrentProcessorNumber WaitForSingleObject SetEvent CloseHandle InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcessId RtlCaptureStackBackTrace WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError DecodePointer UnhandledExceptionFilter GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlUnwind ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle GetCommandLineA GetCommandLineW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP GetConsoleMode ReadConsoleW FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableCS InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer HeapQueryInformation GetACP GetOEMCP SetEnvironmentVariableW SetStdHandle Sleep GetStringTypeW IsProcessorFeaturePresent GetModuleHandleExW SwitchToThread GetExitCodeThread GetNativeSystemInfo TryAcquireSRWLockExclusive GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFinalPathNameByHandleW SetFileInformationByHandle GetTempPathW CopyFileW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitializeConditionVariable WakeConditionVariable RtlPcToFileHeader RaiseException InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork WriteConsoleW

user32

EnumWindows GetShellWindow ExitWindowsEx UnregisterClassW GetWindowThreadProcessId

shell32

ShellExecuteExW ord51 SHGetKnownFolderPath SHGetFileInfoW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoInitializeEx CoUninitialize

advapi32

GetNamedSecurityInfoW SetServiceStatus StartServiceCtrlDispatcherW CreateProcessAsUserW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA CryptGenRandom CryptReleaseContext CryptAcquireContextA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegDeleteTreeW RegRenameKey RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW SetNamedSecurityInfoW RegisterServiceCtrlHandlerW SetEntriesInAclW ConvertSidToStringSidW CreateProcessWithTokenW LookupPrivilegeValueW LookupAccountSidW GetTokenInformation FreeSid EqualSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegGetValueW RegOpenKeyExW LookupAccountNameW

dbgeng

DebugCreate

ws2_32

WSAStartup WSACleanup

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

wintrust

WinVerifyTrust

crypt32

CertFindCertificateInStore CertCloseStore CryptMsgClose CertFreeCertificateContext CryptQueryObject

Name

.text

Size

8.1MB

Virtual Size

8.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

655KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

496KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

628KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_89cabe75fa58df0e6674689a47413ae7_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

authz

version

msi

shlwapi

userenv

wtsapi32

secur32

kernel32

user32

shell32

ole32

advapi32

dbgeng

ws2_32

bcrypt

wintrust

crypt32

generic