2026-08-04_9ae3afe7fd8c3666cda8dd286f7edafe_cobalt-strike_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_9ae3afe7fd8c3666cda8dd286f7edafe_cobalt-strike_glassworm_icedid_njrat_stealc
Size 14.8MB
Sample260804-2he92ssarh
SHA256 e258e0f29aec90e26b40219fd6814b4e910c6e32d26c0700f11d0f6f4c00c91e
MD5 9ae3afe7fd8c3666cda8dd286f7edafe
SHA1 53ec97d21837acba4dba51e05264bb20252c72d0
SHA512 5c698866ee19517542452a46e93d2468f353e009e92b4d8b1999eed11207eb4cacc93f1f0be280e90a98c7b38cabf46154511b091427ae51dc4964d7f9e02086
SSDEEP 98304:k0G+WPdR+7BOXylM/immfd9ErWo/Y7mgTm05AwJHE6hYj0ICtwE+XuDJuhq:JadR+CylMKzcg7PAmkNIEE3d
TLSH
T167F6D9C68136D191C1E8B63431557123EF2BF85D923CA26A9FF28F1536FFF40A46A618
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_9ae3afe7fd8c3666cda8dd286f7edafe_cobalt-strike_glassworm_icedid_njrat_stealc

File Explorer

2026-08-04_9ae3afe7fd8c3666cda8dd286f7edafe_cobalt-strike_glassworm_icedid_njrat_stealc

.exe 14.8MB

2026-08-04_9ae3afe7fd8c3666cda8dd286f7edafe_cobalt-strike_glassworm_icedid_njrat_stealc

IMPHASH 1dfddaa0bb7a2305c39d961ef7d6afb1
SHA256 e258e0f29aec90e26b40219fd6814b4e910c6e32d26c0700f11d0f6f4c00c91e
MD5 9ae3afe7fd8c3666cda8dd286f7edafe
SHA1 53ec97d21837acba4dba51e05264bb20252c72d0
SHA512 5c698866ee19517542452a46e93d2468f353e009e92b4d8b1999eed11207eb4cacc93f1f0be280e90a98c7b38cabf46154511b091427ae51dc4964d7f9e02086
SSDEEP 98304:k0G+WPdR+7BOXylM/immfd9ErWo/Y7mgTm05AwJHE6hYj0ICtwE+XuDJuhq:JadR+CylMKzcg7PAmkNIEE3d
TLSH
T167F6D9C68136D191C1E8B63431557123EF2BF85D923CA26A9FF28F1536FFF40A46A618
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10560016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GlobalLock GlobalUnlock GlobalAlloc GlobalFree GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA GetProcAddress FreeLibrary GetModuleHandleA QueryFullProcessImageNameA GetModuleHandleW GetFileAttributesExW WaitForSingleObjectEx RtlUnwind ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleCP SetConsoleOutputCP GetCommandLineW HeapSize SetEndOfFile SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage HeapReAlloc GetConsoleOutputCP EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect ReadConsoleW HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetCommandLineA IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess GetConsoleCP FlsFree FlsSetValue VerifyVersionInfoW VerSetConditionMask GetUserDefaultGeoName GetUserDefaultLCID Process32NextW OpenProcess Process32FirstW WaitForSingleObject SetWaitableTimerEx CreateWaitableTimerExW GetTickCount MoveFileExW Sleep ReadFile GetTickCount64 Module32NextW Module32FirstW FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetFileSizeEx CreateFileA WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA MoveFileExA FormatMessageW SetLastError GetSystemDirectoryA SleepEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer WakeAllConditionVariable WakeConditionVariable InitOnceComplete InitOnceBeginInitialize GetExitCodeThread GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 DeleteFileW GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW CreateToolhelp32Snapshot WideCharToMultiByte ReadProcessMemory VirtualQueryEx CloseHandle FlushFileBuffers WriteFile GetLastError CreateFileW GetEnvironmentVariableW SetConsoleTextAttribute SetConsoleMode SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetConsoleCursorInfo FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx LocalFree FormatMessageA GetModuleFileNameW GetConsoleCursorInfo WriteConsoleW MultiByteToWideChar GetConsoleMode FlsGetValue GetStdHandle

user32

SetCapture keybd_event SetForegroundWindow SetFocus ReleaseCapture IsChild GetWindowThreadProcessId SetCursorPos GetSystemMetrics SetWindowPos GetAsyncKeyState DefWindowProcW PostQuitMessage IsIconic mouse_event FindWindowW GetForegroundWindow ShowCursor SetWindowLongW UpdateWindow ShowWindow UnregisterClassW SetLayeredWindowAttributes CreateWindowExW RegisterClassExW OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetKeyboardLayout GetWindowLongW LoadCursorW GetKeyState ClientToScreen GetCursorPos ScreenToClient GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture IsWindowUnicode SetProcessDPIAware GetDC ReleaseDC MonitorFromWindow DestroyWindow UnregisterClassA GetMonitorInfoA EnumDisplaySettingsA FindWindowA PeekMessageW TranslateMessage DispatchMessageW SetWindowDisplayAffinity SetCursor

gdi32

CreateDCA DeleteDC GetDeviceCaps

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptGenRandom CryptAcquireContextA RegOpenKeyExA RegQueryValueExA RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext

shell32

ShellExecuteA SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

VariantInit VariantClear SysAllocString

normaliz

IdnToAscii

ws2_32

accept gethostname ioctlsocket send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select sendto htonl listen getaddrinfo freeaddrinfo recvfrom

wldap32

ord46 ord211 ord60 ord45 ord50 ord41 ord217 ord26 ord27 ord32 ord33 ord35 ord79 ord22 ord30 ord200 ord301 ord143

crypt32

PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

bcrypt

BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptCreateHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

dcomp

DCompositionCreateDevice

Name

.text

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

509KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_9ae3afe7fd8c3666cda8dd286f7edafe_cobalt-strike_glassworm_icedid_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

normaliz

ws2_32

wldap32

crypt32

bcrypt

d3d11

d3dcompiler_47

dwmapi

imm32

dcomp

generic