2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
Size 8.0MB
Sample260807-bavfwsdp41
SHA256 65782c880f9622704e4f20771ad8287046cea6723fa0f876d386fb48c49bafab
MD5 2f049647f7c844c9a84fece81379318d
SHA1 820e6d7d45e0b21d355a5c67d8d52f0d2af78dbc
SHA512 439d63e854c2d86a1da4872e10d2f4146b12ad814953f2161a834da5e519dcba6a97e246d06e2d3c1d8a49276c613c5adb68883bddb958a1fe5cf4f4428107a5
SSDEEP 98304:84a8kHtsiUS64kVlGQgCEKPQ/eUaOVgB/AU0MTLm:Fm7Udnmss9Lc/AUtTL
TLSH
T123867C53F2A611F8C01EC978876E5632A9757C4A1B34A3EF0AE43A211E75ED46B3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

File Explorer

2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

.exe 8.0MB

2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

IMPHASH 45215a717f2bb6196be37cd381b7e7ef
SHA256 65782c880f9622704e4f20771ad8287046cea6723fa0f876d386fb48c49bafab
MD5 2f049647f7c844c9a84fece81379318d
SHA1 820e6d7d45e0b21d355a5c67d8d52f0d2af78dbc
SHA512 439d63e854c2d86a1da4872e10d2f4146b12ad814953f2161a834da5e519dcba6a97e246d06e2d3c1d8a49276c613c5adb68883bddb958a1fe5cf4f4428107a5
SSDEEP 98304:84a8kHtsiUS64kVlGQgCEKPQ/eUaOVgB/AU0MTLm:Fm7Udnmss9Lc/AUtTL
TLSH
T123867C53F2A611F8C01EC978876E5632A9757C4A1B34A3EF0AE43A211E75ED46B3CF14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3255504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

setup.exe.pdb

advapi32

AddAce AdjustTokenPrivileges AllocateAndInitializeSid BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW ChangeServiceConfig2W ChangeServiceConfigW CheckTokenMembership CloseServiceHandle ControlService ConvertSidToStringSidA ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateServiceW CreateWellKnownSid CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptHashData CryptReleaseContext CryptVerifySignatureW DeleteService DuplicateTokenEx EqualSid FreeSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle GetUserNameW ImpersonateNamedPipeClient InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidAcl IsValidSecurityDescriptor IsValidSid IsWellKnownSid LookupAccountNameW LookupAccountSidW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW RegEnumValueA RegEnumValueW RegLoadKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegRenameKey RegSetValueExW RegUnLoadKeyW RegisterServiceCtrlHandlerExW RegisterTraceGuidsW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorControl SetSecurityDescriptorDacl SetSecurityDescriptorOwner SetSecurityInfo SetServiceStatus SetTokenInformation StartServiceCtrlDispatcherW StartServiceW SystemFunction036 TraceEvent UnregisterTraceGuids

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetModuleInfo64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW ord190 ord155 ord680 SHAssocEnumHandlers SHAssocEnumHandlersForProtocolByApplication SHChangeNotify SHCreateAssociationRegistration SHCreateItemFromParsingName SHGetFolderPathW SHGetKnownFolderPath SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW

user32

AllowSetForegroundWindow CharUpperW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnumWindows GetActiveWindow GetMessageW GetMonitorInfoW GetQueueStatus GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowThreadProcessId IsWindow IsWindowVisible KillTimer LoadStringW MessageBoxW MonitorFromWindow MoveWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RegisterClassExW RegisterClassW RegisterWindowMessageW SendMessageW SetTimer SetWindowLongPtrW SetWindowPos TranslateMessage UnregisterClassW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DosDateTimeToFileTime DuplicateHandle EncodePointer EnterCriticalSection EnumResourceLanguagesW EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToDosDateTime FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileTime GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDriveStringsW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNativeSystemInfo GetOEMCP GetPriorityClass GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPreferredUILanguages GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserGeoID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapDestroy HeapFree HeapLock HeapReAlloc HeapSetInformation HeapSize HeapUnlock HeapWalk InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessInJob IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32EnumProcessModules K32GetModuleFileNameExW K32GetModuleInformation K32GetPerformanceInfo K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFileTimeToFileTime LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenEventW OpenJobObjectW OpenMutexW OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW QueryDosDeviceW QueryFullProcessImageNameW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime QueryUnbiasedInterruptTime QueueUserAPC RaiseException ReadConsoleW ReadDirectoryChangesW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WerRegisterRuntimeExceptionModule WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile WritePrivateProfileStringW WriteProcessMemory lstrcmpA lstrcmpiW lstrcpynW lstrlenW

ole32

CoAllowSetForegroundWindow CoCreateGuid CoCreateInstance CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear StringFromCLSID StringFromGUID2

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

propsys

InitPropVariantFromCLSID

ntdll

NtClose NtDeleteKey NtOpenKeyEx NtQueryInformationProcess NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

winmm

timeBeginPeriod timeEndPeriod timeGetTime

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

AssocQueryStringW ord176 PathMatchSpecW UrlEscapeW

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy VariantInit

wininet

HttpQueryInfoW InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile InternetSetFilePointer InternetSetOptionW InternetSetStatusCallbackW

crypt32

CertCloseStore CryptDecodeObjectEx CryptImportPublicKeyInfo CryptMsgClose CryptMsgGetAndVerifySigner CryptProtectData CryptQueryObject CryptUnprotectData

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

secur32

GetUserNameExW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

150KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

737B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

LZMADEC

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

195B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

239KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_2f049647f7c844c9a84fece81379318d_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

advapi32

dbghelp

shell32

user32

kernel32

ole32

wtsapi32

version

propsys

ntdll

winmm

userenv

shlwapi

oleaut32

wininet

crypt32

wintrust

secur32

winhttp

api-ms-win-core-synch-l1-2-0

generic