General
- Target 2026-08-03_6eafa8556777496d95ea0852546dcfcc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
- Size 1.3MB
- Sample260803-rwjvaaba23
- SHA256 53c5c686de41ecd16ac2c6ae9a94e344050e6daa354b1dd9053dc0c90b7cab83
- MD5 6eafa8556777496d95ea0852546dcfcc
- SHA1 d75c8e1b2ecbee7aa6269282b8e7e66ba21ab9c6
- SHA512 ba3db08f9282be243a2db4ff49faae46b1137dccd0216ac1a59ef95aeaa2649ae2b7f99a3fd24addf19276257e92e3f47628c3fb92827813eb7d1975b8ddd6b5
- SSDEEP 24576:wV/9a379UtePLBp9/p/kIL/Z0ooNfQsCXoXMcpZH0YKnQ/tbw/2Mkjy6Fr7g0oj:wCLuePLBp9/p/kILhoOXoccczQ/lFTjG
- TLSH T18165CF2BA35901FAD06EC1798B565112EA71FC550B74B6DF03A093263E36BE06F3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_6eafa8556777496d95ea0852546dcfcc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_6eafa8556777496d95ea0852546dcfcc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_6eafa8556777496d95ea0852546dcfcc_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
- Size 1.3MB
- SHA256 53c5c686de41ecd16ac2c6ae9a94e344050e6daa354b1dd9053dc0c90b7cab83
- MD5 6eafa8556777496d95ea0852546dcfcc
- SHA1 d75c8e1b2ecbee7aa6269282b8e7e66ba21ab9c6
- SHA512 ba3db08f9282be243a2db4ff49faae46b1137dccd0216ac1a59ef95aeaa2649ae2b7f99a3fd24addf19276257e92e3f47628c3fb92827813eb7d1975b8ddd6b5
- SSDEEP 24576:wV/9a379UtePLBp9/p/kIL/Z0ooNfQsCXoXMcpZH0YKnQ/tbw/2Mkjy6Fr7g0oj:wCLuePLBp9/p/kILhoOXoccczQ/lFTjG
- TLSH T18165CF2BA35901FAD06EC1798B565112EA71FC550B74B6DF03A093263E36BE06F3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1