General
- Target 2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 7.9MB
- Sample260804-3eqgaaac69
- SHA256 8d9f7b5662d405c004ad65f4b5d00486ac0242753bc807c5b25ce00c6ce9491b
- MD5 08fd2e191c9eaa7b564fdf1d7b6c81e4
- SHA1 854eb912f1802ebc392ca8fceaa31ce4b32a2269
- SHA512 c1e9865c559b7204a3fa348e3bc1cc5b6ebf85da0b10fd1057a32adf58b15f0508373a1e9dd1ca0f0c4f8bf00c6a7324bafe7a9a4f4c99619f5b494044e6b231
- SSDEEP 98304:/rzXpkF0J99JITGW45jxvdz4uzBGVXvYCp3nyG://CFE7I4fBGVTp3n
- TLSH T14F868D13F2A501FCD05ED974CF3952329A357C4A4BB0A2EF269836E11A75ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
22 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_08fd2e191c9eaa7b564fdf1d7b6c81e4_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 7.9MB
- SHA256 8d9f7b5662d405c004ad65f4b5d00486ac0242753bc807c5b25ce00c6ce9491b
- MD5 08fd2e191c9eaa7b564fdf1d7b6c81e4
- SHA1 854eb912f1802ebc392ca8fceaa31ce4b32a2269
- SHA512 c1e9865c559b7204a3fa348e3bc1cc5b6ebf85da0b10fd1057a32adf58b15f0508373a1e9dd1ca0f0c4f8bf00c6a7324bafe7a9a4f4c99619f5b494044e6b231
- SSDEEP 98304:/rzXpkF0J99JITGW45jxvdz4uzBGVXvYCp3nyG://CFE7I4fBGVTp3n
- TLSH T14F868D13F2A501FCD05ED974CF3952329A357C4A4BB0A2EF269836E11A75ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1