General
- Target 2026-08-04_15ee405fb63430b8f9b6942dcfe1f9b4_cobalt-strike_glassworm_icedid_remcos_ryuk_satacom_stealc_vidar_xworm
- Size 526KB
- Sample260804-j5rx9aaq2t
- SHA256 b3b840ff4f930724f4217d93b874a2902d38687cc21f8ea6d0d2e69ce39c4370
- MD5 15ee405fb63430b8f9b6942dcfe1f9b4
- SHA1 3c85e8d6b46e804e885be4f074329955ff9fa60f
- SHA512 3d77e3f1c1d2350d8347f4b9c6ee62ff7c5fee120e27a7ec870a01f1dde6dfe6d3a5ead604bfbc6edec131fd02cfb7048a77430d69c677c464f89ce09ee78a50
- SSDEEP 12288:pYCDi50NiQDuysMFZzN/E/msuY7scjRB+k67q:693genjRB27q
- TLSH T193B45C16F7E404BCF4B38634897656529A35BC678B31DAEF17C402691F32AE08E35B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-04_15ee405fb63430b8f9b6942dcfe1f9b4_cobalt-strike_glassworm_icedid_remcos_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_15ee405fb63430b8f9b6942dcfe1f9b4_cobalt-strike_glassworm_icedid_remcos_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_15ee405fb63430b8f9b6942dcfe1f9b4_cobalt-strike_glassworm_icedid_remcos_ryuk_satacom_stealc_vidar_xworm
- Size 526KB
- SHA256 b3b840ff4f930724f4217d93b874a2902d38687cc21f8ea6d0d2e69ce39c4370
- MD5 15ee405fb63430b8f9b6942dcfe1f9b4
- SHA1 3c85e8d6b46e804e885be4f074329955ff9fa60f
- SHA512 3d77e3f1c1d2350d8347f4b9c6ee62ff7c5fee120e27a7ec870a01f1dde6dfe6d3a5ead604bfbc6edec131fd02cfb7048a77430d69c677c464f89ce09ee78a50
- SSDEEP 12288:pYCDi50NiQDuysMFZzN/E/msuY7scjRB+k67q:693genjRB27q
- TLSH T193B45C16F7E404BCF4B38634897656529A35BC678B31DAEF17C402691F32AE08E35B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Modifies system executable filetype association