2026-08-05_30a884c56041929945cff98494dec267_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_30a884c56041929945cff98494dec267_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 1.4MB
Sample260805-23jszahn3x
SHA256 d1c985faacf0034ba43b3fa0b0932ad17c1322facee81c0dcec3cae25dcf97a4
MD5 30a884c56041929945cff98494dec267
SHA1 9e7feb3b22b0194d3999aa4a1fd12b7b89a97b67
SHA512 f9a533ac74316ae3cb6753261016b148459502eccb6b50b7e79b815530536bdc9aebb1af8a2585b11be6388154a2399c16e88ccbad2163756d468e04e98de456
SSDEEP 24576:K1rNmMUwiFR3zt4OkHbuqih0lhSMXl8AOOXMP:W8Bzt4df/MjOXM
TLSH
T1BC659D21A3A800BCD0B7C1F8CA565A07F372B446433156DF37AC5A661F57AE69E3BB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_30a884c56041929945cff98494dec267_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-05_30a884c56041929945cff98494dec267_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 1.4MB

2026-08-05_30a884c56041929945cff98494dec267_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 172d3490d30298b31e2d87f2362efa57
SHA256 d1c985faacf0034ba43b3fa0b0932ad17c1322facee81c0dcec3cae25dcf97a4
MD5 30a884c56041929945cff98494dec267
SHA1 9e7feb3b22b0194d3999aa4a1fd12b7b89a97b67
SHA512 f9a533ac74316ae3cb6753261016b148459502eccb6b50b7e79b815530536bdc9aebb1af8a2585b11be6388154a2399c16e88ccbad2163756d468e04e98de456
SSDEEP 24576:K1rNmMUwiFR3zt4OkHbuqih0lhSMXl8AOOXMP:W8Bzt4df/MjOXM
TLSH
T1BC659D21A3A800BCD0B7C1F8CA565A07F372B446433156DF37AC5A661F57AE69E3BB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

591344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind NtQueryObject NtQueryInformationProcess NtQuerySystemInformation RtlUnwind

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpCrackUrl

crypt32

CryptUnprotectData CryptProtectData CryptStringToBinaryA CryptBinaryToStringA

dwmapi

DwmSetWindowAttribute

kernel32

ReadFile WriteFile CloseHandle DuplicateHandle PeekNamedPipe WaitForSingleObject CreateMutexW CreateEventW GetProcessTimes GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemTimes GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW LocalFree MultiByteToWideChar WideCharToMultiByte K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW GetLastError CreateProcessA MoveFileExA GetFileAttributesW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryExW FreeLibrary SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect HeapAlloc UnhandledExceptionFilter IsDebuggerPresent GetStdHandle IsProcessorFeaturePresent ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle FindNextFileW FindFirstFileW FindClose CreateFileW CompareFileTime ExpandEnvironmentStringsA SetEnvironmentVariableW GetProcAddress GetModuleHandleW GetModuleFileNameA Sleep GetFileAttributesA DeleteFileA FindFirstFileExW CreateDirectoryW GetFileAttributesExW SleepConditionVariableSRW WriteConsoleW HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx GetLocaleInfoEx FormatMessageA SetEndOfFile GetSystemTimePreciseAsFileTime QueryPerformanceFrequency HeapReAlloc GetOEMCP GetACP IsValidCodePage QueryPerformanceCounter ReadConsoleW

user32

GetMessageA TranslateMessage UnregisterHotKey RegisterHotKey PostMessageA AttachThreadInput DefWindowProcW PostQuitMessage TrackMouseEvent CreateWindowExW IsWindow DestroyWindow ShowWindow PrintWindow SetWindowPos IsWindowVisible IsIconic SetFocus SetTimer KillTimer GetSystemMetrics DrawTextW UpdateWindow DispatchMessageA FindWindowW SendMessageW RegisterClassExW GetForegroundWindow SetForegroundWindow GetDC ReleaseDC BeginPaint EndPaint EnumDisplayMonitors GetMonitorInfoA SystemParametersInfoW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes EnumDisplayDevicesA MessageBoxW GetWindowTextW SetWindowTextW MonitorFromPoint LoadIconW LoadIconA LoadCursorA GetWindowThreadProcessId GetClassNameW EnumWindows GetDesktopWindow SetWindowLongPtrW SetWindowLongPtrA GetWindowLongPtrW GetWindowLongPtrA FillRect GetCursorPos GetWindowRect GetClientRect RemovePropW SetPropW InvalidateRect SetWindowRgn

gdi32

MoveToEx SelectObject SetTextColor SetBkMode RoundRect LineTo GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgn CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap CombineRgn BitBlt

shell32

SHGetFolderPathW ShellExecuteA Shell_NotifyIconW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree CoCreateGuid

advapi32

RegOpenKeyExW RegCloseKey RegGetValueW RegQueryValueExW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegQueryValueExA RegOpenKeyExA RegSetValueExW RegCreateKeyExW RegDeleteValueW

pdh

PdhAddCounterW PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterArrayW PdhOpenQueryA

gdiplus

GdipAlloc GdiplusShutdown GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders

msimg32

GradientFill

shlwapi

ord12

Name

.text

Size

754KB

Virtual Size

754KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

336KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_30a884c56041929945cff98494dec267_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

ntdll

winhttp

crypt32

dwmapi

kernel32

user32

gdi32

shell32

ole32

advapi32

pdh

gdiplus

msimg32

shlwapi

generic