2026-08-03_4baaf5e8c5c844926e4abed629761f17_cobalt-strike_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_4baaf5e8c5c844926e4abed629761f17_cobalt-strike_glassworm_icedid_njrat_stealc
Size 386KB
Sample260804-n9dcwaej2x
SHA256 1586574e69b6c494014437ac9e9bf561d92c14f0e999ab5a0863a7efb7673031
MD5 4baaf5e8c5c844926e4abed629761f17
SHA1 3ce8303233812512bfedc3808d671022c25c8f18
SHA512 5bf744287bc63b7a0704a68b188d07ddb9967860838bc6b563556491312d9ab203157e7cfdca1089f8986953e2808e3fb57db9e33f9388d3a23213a5edb6bbdf
SSDEEP 6144:DvIbElrjug3GFHlYQW3GoddUe38ovU5Aww/prxVdfGew:Dt8YQWD38ovYFwJy
TLSH
T162847D19EBE500F9E1B7C278CD634506EA727C8A0771EADF23954A5A0F236D09E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_4baaf5e8c5c844926e4abed629761f17_cobalt-strike_glassworm_icedid_njrat_stealc

File Explorer

2026-08-03_4baaf5e8c5c844926e4abed629761f17_cobalt-strike_glassworm_icedid_njrat_stealc

.exe 386KB

2026-08-03_4baaf5e8c5c844926e4abed629761f17_cobalt-strike_glassworm_icedid_njrat_stealc

IMPHASH 5455ccafc956373724edfd1b759f0d7a
SHA256 1586574e69b6c494014437ac9e9bf561d92c14f0e999ab5a0863a7efb7673031
MD5 4baaf5e8c5c844926e4abed629761f17
SHA1 3ce8303233812512bfedc3808d671022c25c8f18
SHA512 5bf744287bc63b7a0704a68b188d07ddb9967860838bc6b563556491312d9ab203157e7cfdca1089f8986953e2808e3fb57db9e33f9388d3a23213a5edb6bbdf
SSDEEP 6144:DvIbElrjug3GFHlYQW3GoddUe38ovU5Aww/prxVdfGew:Dt8YQWD38ovYFwJy
TLSH
T162847D19EBE500F9E1B7C278CD634506EA727C8A0771EADF23954A5A0F236D09E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW CommandLineToArgvW Shell_NotifyIconW

kernel32

FindClose WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess Sleep GetLastError K32GetModuleBaseNameW CloseHandle CreateThread K32EnumProcesses LocalFree GetCurrentProcessId CreateProcessW GetModuleHandleW WideCharToMultiByte K32EnumProcessModules FlushFileBuffers VirtualProtect VirtualFree FindNextFileW GetCurrentProcess UnmapViewOfFile GetModuleHandleA CreateFileA K32GetModuleInformation GetProcAddress CreateFileMappingW MapViewOfFile EndUpdateResourceW DeleteFileW UpdateResourceW GetFileSize GetComputerNameW CopyFileW BeginUpdateResourceW GetSystemTime SetFilePointer VirtualAlloc CreateToolhelp32Snapshot GetExitCodeThread Process32NextW TerminateThread LoadLibraryA Process32FirstW Beep VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx IsWow64Process SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW WriteFile GetModuleFileNameW GetCommandLineW FindFirstFileW ReadFile RtlUnwind HeapSize WriteConsoleW SetEndOfFile WriteProcessMemory HeapAlloc QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType GetTimeZoneInformation GetConsoleOutputCP GetConsoleMode HeapFree

user32

PostMessageW DestroyWindow SetWindowLongPtrW CreateWindowExW SendMessageW GetSystemMetrics CreatePopupMenu GetWindowLongPtrW DefWindowProcW DispatchMessageW RegisterClassW DestroyMenu TranslateMessage LoadIconW LoadCursorW AppendMenuW PostQuitMessage UpdateWindow SetForegroundWindow GetCursorPos GetMessageW TrackPopupMenu

gdi32

CreateFontW

advapi32

CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam GetUserNameW CryptReleaseContext CryptDestroyHash

ntdll

RtlAdjustPrivilege

Name

.text

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text13

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text4

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text98

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata48

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata48

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data36

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_4baaf5e8c5c844926e4abed629761f17_cobalt-strike_glassworm_icedid_njrat_stealc

shell32

kernel32

user32

gdi32

advapi32

ntdll

generic