General
- Target 2026-08-06_81ad50ca24212893cdcc0ba99f0377de_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- Sample260806-qh4f4aaa64
- SHA256 0f01dbbaadefb7122d7b33d8e5fcbcec94ba8cafdc02c85b37aa21e06b17d188
- MD5 81ad50ca24212893cdcc0ba99f0377de
- SHA1 6ae87359d799eb74bc521de8cf3657dce54ce805
- SHA512 7b68acc6e3cde7c88770aaaab9151df2c776961881de4d3a8cc5e62908a970a74e54bc80a72c326b026f9e74145364bba21316447dd201a0a20debbb88b703a0
- SSDEEP 98304:2SpbOrf4DgU6vBELOnTWPBx6wR/QKiKkKURgyLjR+gEiWyssUhV18/h:9ZOr1WoWnRlQRpEqsFhj8/
- TLSH T15BA67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_81ad50ca24212893cdcc0ba99f0377de_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_81ad50ca24212893cdcc0ba99f0377de_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- SHA256 0f01dbbaadefb7122d7b33d8e5fcbcec94ba8cafdc02c85b37aa21e06b17d188
- MD5 81ad50ca24212893cdcc0ba99f0377de
- SHA1 6ae87359d799eb74bc521de8cf3657dce54ce805
- SHA512 7b68acc6e3cde7c88770aaaab9151df2c776961881de4d3a8cc5e62908a970a74e54bc80a72c326b026f9e74145364bba21316447dd201a0a20debbb88b703a0
- SSDEEP 98304:2SpbOrf4DgU6vBELOnTWPBx6wR/QKiKkKURgyLjR+gEiWyssUhV18/h:9ZOr1WoWnRlQRpEqsFhj8/
- TLSH T15BA67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1