2026-08-06_ccd6e5d3f5ec0a5443520981d606ac4a_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

General

Target
2026-08-06_ccd6e5d3f5ec0a5443520981d606ac4a_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 2.3MB
Sample260806-p52eks1fna
SHA256 43e0b7a677f4eace40b0dca90a091fc83ccf5f25a79cc3f3afbf3beaa0a78507
MD5 ccd6e5d3f5ec0a5443520981d606ac4a
SHA1 233183c2004d38d2759fdae5149a5fbf0443ce96
SHA512 5e4017ef4d63d8fddd4a8f9a91a0a2242e9ada79e34b811729d3b343d203490da672815cb25c0aa7674b75a8e09f9a0fd397f37b3f8ef42c350128c942aa6771
SSDEEP 49152:zMjBVbqjiodHKzWFdiZe+I71DJ+G/e59eSBDmg27RnWGj:zoBV2jief75bSBD527BWG
TLSH
T1C0B5E0FFD79885F2F43287B8C92258E8C1257CA4A331A0DF5615715FAE7E9908837E21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_ccd6e5d3f5ec0a5443520981d606ac4a_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-06_ccd6e5d3f5ec0a5443520981d606ac4a_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 2.3MB

2026-08-06_ccd6e5d3f5ec0a5443520981d606ac4a_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 6e8f04432e2d9b5fa9f930708480b8c9
SHA256 43e0b7a677f4eace40b0dca90a091fc83ccf5f25a79cc3f3afbf3beaa0a78507
MD5 ccd6e5d3f5ec0a5443520981d606ac4a
SHA1 233183c2004d38d2759fdae5149a5fbf0443ce96
SHA512 5e4017ef4d63d8fddd4a8f9a91a0a2242e9ada79e34b811729d3b343d203490da672815cb25c0aa7674b75a8e09f9a0fd397f37b3f8ef42c350128c942aa6771
SSDEEP 49152:zMjBVbqjiodHKzWFdiZe+I71DJ+G/e59eSBDmg27RnWGj:zoBV2jief75bSBD527BWG
TLSH
T1C0B5E0FFD79885F2F43287B8C92258E8C1257CA4A331A0DF5615715FAE7E9908837E21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

96416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\bitqh\AVRETAIL\qhav\bin\Upgrade\x64\Release\upgui.pdb

kernel32

DeleteCriticalSection FindNextFileW GetLongPathNameW GetModuleFileNameW FindClose CopyFileW WideCharToMultiByte GetPrivateProfileIntW GetPrivateProfileStringW OutputDebugStringW FreeLibrary LoadLibraryExW GetCommandLineW LoadLibraryW LocalFree MultiByteToWideChar WriteFile CreateFileW CloseHandle OutputDebugStringA LocalAlloc InitializeCriticalSection SizeofResource HeapFree GetFullPathNameW CreateMutexW InitializeCriticalSectionEx ReleaseMutex HeapSize LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc GetCurrentDirectoryW HeapDestroy SetCurrentDirectoryW GetWindowsDirectoryW GetProcessHeap OpenMutexW WriteConsoleW FlushFileBuffers GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA LeaveCriticalSection EnterCriticalSection GetModuleHandleW VerSetConditionMask IsProcessorFeaturePresent GetProcAddress GetLastError LoadLibraryA GetVersionExW GetCPInfo GetOEMCP GetACP InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection GetCurrentThreadId QueryPerformanceCounter FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileAttributesExW GetConsoleMode GetFileType ExitProcess GetModuleHandleExW GetStdHandle SetStdHandle SetFilePointerEx GetConsoleOutputCP LCMapStringW FindFirstFileExW IsValidCodePage

user32

GetSystemMetrics MessageBoxW

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW

shell32

CommandLineToArgvW

Name

.text

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_ccd6e5d3f5ec0a5443520981d606ac4a_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

kernel32

user32

advapi32

shell32

generic