2026-08-02_854826667f293774ad78ba6f14c86b95_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_854826667f293774ad78ba6f14c86b95_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 458KB
Sample260802-kapp3sydkf
SHA256 5ef5c3ff86650e3001b9848027ff261d461a923edbe4dd795d944723301a881c
MD5 854826667f293774ad78ba6f14c86b95
SHA1 03546f1ce4576f19c55ef820f6b553b431c33471
SHA512 0103adb46f6115cfc0b2b2b0fcf67117c85763bef5405fd42c4eb6d10973baf80dc66a9d2c7bc3f06aacc51518053cc3ec5546bf283e1e6b5870523240b00ebb
SSDEEP 6144:Hi2YZFIteJ44B+ab3pQB6SI2EeihKB7nhx0EEITMRj2YJxqxD0AoiPo:C28IIO4bCCjZKNdTijjLqxz
TLSH
T1DEA47D19A6A410F9D1B7C138CD570507EA72BC464334EEEB0394EAB61F276E09E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_854826667f293774ad78ba6f14c86b95_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-02_854826667f293774ad78ba6f14c86b95_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 458KB

2026-08-02_854826667f293774ad78ba6f14c86b95_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 7f6ba551dd011da3bd3572a2d497ad5b
SHA256 5ef5c3ff86650e3001b9848027ff261d461a923edbe4dd795d944723301a881c
MD5 854826667f293774ad78ba6f14c86b95
SHA1 03546f1ce4576f19c55ef820f6b553b431c33471
SHA512 0103adb46f6115cfc0b2b2b0fcf67117c85763bef5405fd42c4eb6d10973baf80dc66a9d2c7bc3f06aacc51518053cc3ec5546bf283e1e6b5870523240b00ebb
SSDEEP 6144:Hi2YZFIteJ44B+ab3pQB6SI2EeihKB7nhx0EEITMRj2YJxqxD0AoiPo:C28IIO4bCCjZKNdTijjLqxz
TLSH
T1DEA47D19A6A410F9D1B7C138CD570507EA72BC464334EEEB0394EAB61F276E09E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

152752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\po\Desktop\CP-StartUp\x64\Release\Client.pdb

kernel32

CopyFileA GetLastError GetFileAttributesA Process32NextW CreateFileA DeleteFileA Process32FirstW CloseHandle GetSystemInfo CreateThread SetFileAttributesA GetLocalTime GetLogicalDriveStringsA Beep GetProcAddress GlobalLock RemoveDirectoryA SystemTimeToFileTime GlobalMemoryStatusEx WideCharToMultiByte CreateProcessA GetDiskFreeSpaceExA CreateDirectoryA GlobalUnlock IsDebuggerPresent GetComputerNameA SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW HeapReAlloc GetTickCount64 GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapAlloc CreatePipe GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary LocalFileTimeToFileTime GetTempPathA Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetCurrentDirectoryA OpenProcess GetModuleHandleA GetCurrentDirectoryA WaitForSingleObject GetVolumeInformationA CreateMutexA GetOEMCP FindClose FindNextFileA SetFileTime GetDriveTypeA TerminateProcess GetStdHandle GetCurrentProcess FindFirstFileA SetHandleInformation GetFileAttributesExA MoveFileA CompareFileTime GetModuleFileNameA ExitThread FlsFree FlsSetValue RtlUnwind FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW SleepConditionVariableSRW WakeAllConditionVariable QueryPerformanceCounter LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree ReadFile InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread

user32

SetWindowLongPtrA PostQuitMessage KillTimer UnregisterClassA GetWindowLongPtrA GetDlgItem SystemParametersInfoA GetClipboardData TranslateMessage SwapMouseButton DefWindowProcA EnumWindows RegisterClassA BlockInput MessageBoxA MapVirtualKeyA SetWindowTextA SetForegroundWindow InvalidateRect SetCursorPos ReleaseDC BeginPaint SendInput LockWorkStation GetWindowTextA ExitWindowsEx CreateWindowExA IsWindowVisible CallWindowProcA GetMessageA GetClassLongPtrA GetWindow DispatchMessageA GetWindowRect LoadCursorA DestroyWindow GetDC CloseClipboard SetWindowPos PostMessageA FillRect SendMessageW GetSystemMetrics GetClassNameA ShowWindow IsWindow GetAsyncKeyState OpenClipboard GetDlgItemTextA SetTimer EndPaint

gdi32

CreateCompatibleBitmap CreateFontA SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC SetTextColor TextOutA SetBkMode SetStretchBltMode DeleteObject CreateSolidBrush

advapi32

GetUserNameA RegDeleteValueA AdjustTokenPrivileges RegCloseKey RegQueryValueExA LookupPrivilegeValueA GetTokenInformation InitiateSystemShutdownExA RegSetValueExA OpenProcessToken RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitialize CoUninitialize CoInitializeEx

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

bcrypt

BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptDestroyHash BCryptHashData

winmm

waveInReset waveInClose waveInStop waveInUnprepareHeader PlaySoundA waveInOpen waveInStart waveInAddBuffer waveInPrepareHeader mciSendStringA

urlmon

URLDownloadToFileA

avicap32

capCreateCaptureWindowA

Name

.text

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_854826667f293774ad78ba6f14c86b95_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

bcrypt

winmm

urlmon

avicap32

generic