2026-08-08_f36010582d20cfd4020b44dbfe4e3e82_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_f36010582d20cfd4020b44dbfe4e3e82_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 961KB
Sample260808-vkx5baee48
SHA256 8c8c7920eb751f9fb2eb9bea1e6a6507c08dfbeb7ee3f8bcfc62cdaa748f527a
MD5 f36010582d20cfd4020b44dbfe4e3e82
SHA1 5bf22f108e66aaeb2731836d1b43d6fde125a5f0
SHA512 050ff11620d5895d07a9c92fe141155936d6a6802be02ba832b61b648dd046eaa1ec18169e5fa4ba24327f7b521d67760ad68f015f65589e9f18569d02dd69f2
SSDEEP 12288:QG2st231OzqtzLO+T4cT7CN5bRdsSnH3Mo6YltM3HTiia2bxMD2sIHj20DZrUqpH:QG2saOz4bc1RGScUOHTnbquCu4qpFV7
TLSH
T1AC258D3166ED03A8F077B13889564B32E6B5F8890374A9EF137199671F226D39E3B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-08_f36010582d20cfd4020b44dbfe4e3e82_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-08_f36010582d20cfd4020b44dbfe4e3e82_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 961KB

2026-08-08_f36010582d20cfd4020b44dbfe4e3e82_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 6eed8f20171eb6a692f8135f5404f5dc
SHA256 8c8c7920eb751f9fb2eb9bea1e6a6507c08dfbeb7ee3f8bcfc62cdaa748f527a
MD5 f36010582d20cfd4020b44dbfe4e3e82
SHA1 5bf22f108e66aaeb2731836d1b43d6fde125a5f0
SHA512 050ff11620d5895d07a9c92fe141155936d6a6802be02ba832b61b648dd046eaa1ec18169e5fa4ba24327f7b521d67760ad68f015f65589e9f18569d02dd69f2
SSDEEP 12288:QG2st231OzqtzLO+T4cT7CN5bRdsSnH3Mo6YltM3HTiia2bxMD2sIHj20DZrUqpH:QG2saOz4bc1RGScUOHTnbquCu4qpFV7
TLSH
T1AC258D3166ED03A8F077B13889564B32E6B5F8890374A9EF137199671F226D39E3B311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f5:2d:f8:29:de:5f:02:17:52:e3:23:26:d3:cf:27:59:ca:5b:e6:ee

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Chains

Apr 7, 2016

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Subject

CN=viper,O=take2games,L=San Francisco,ST=California,C=US,1.2.840.113549.1.9.1=#0c18436f707972696768744074616b653267616d65732e636f6d

Serial Number

03:e8

Issuer

CN=viper,O=take2games,L=San Francisco,ST=California,C=US,1.2.840.113549.1.9.1=#0c18436f707972696768744074616b653267616d65732e636f6d

Timespan

Jan 27, 2025 - Jan 27, 2026

Subject

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Serial Number

69:50:43:d6:8f:15:55:0f:d5:db:37:0f:a8:81:7b:04

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 21, 2011 - Sep 20, 2013

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

230416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\repos\DelefileApp\x64\Release\DeleteFileApp.pdb

comctl32

ImageList_ReplaceIcon ImageList_Create ImageList_Destroy ImageList_Remove InitCommonControlsEx

comdlg32

GetOpenFileNameW

shell32

SHGetPathFromIDListW ExtractIconExW ShellExecuteExW SHBrowseForFolderW SHGetFileInfoW SHGetFolderPathW DragFinish DragAcceptFiles ShellExecuteW DragQueryFileW

kernel32

Thread32First FindClose WaitForSingleObject CreateFileW GetFileAttributesW SuspendThread GetSystemDirectoryW ResumeThread IsProcessInJob K32EnumProcessModulesEx OpenProcess HeapSize SetFileAttributesW GetLogicalDriveStringsW CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW OutputDebugStringW FileTimeToSystemTime TerminateThread LockResource GlobalAlloc Process32FirstW HeapReAlloc CloseHandle RaiseException GetSystemInfo K32GetModuleInformation LoadLibraryW CancelIoEx GetWindowsDirectoryA LoadResource FindResourceW HeapAlloc GetOverlappedResult DecodePointer SetCurrentDirectoryW GetWindowsDirectoryW GetProcAddress GlobalLock LocalFree GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte SystemTimeToTzSpecificLocalTime QueryFullProcessImageNameW GetTickCount GetTempPathW MulDiv IsWow64Process GetProcessTimes OpenThread GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsDebuggerPresent GetCPInfo LCMapStringEx EncodePointer LeaveCriticalSection EnterCriticalSection GetStringTypeW Wow64GetThreadContext Thread32Next CreateJobObjectW K32GetModuleFileNameExW GetSystemTimes TerminateProcess AssignProcessToJobObject DeviceIoControl WriteFile GetCurrentProcess FindNextFileW GetFullPathNameW SetLastError HeapFree FindFirstFileW SetInformationJobObject QueryDosDeviceW SizeofResource CreateDirectoryW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx FlushFileBuffers InitializeCriticalSectionEx GetConsoleOutputCP GetConsoleMode WriteConsoleW GlobalUnlock

user32

GetDpiForWindow GetPropW SetActiveWindow EnumChildWindows SetWindowLongPtrW CopyIcon GetDC ScreenToClient keybd_event CallNextHookEx GetCursor EndDialog RemovePropW GetSystemMetrics DestroyWindow GetWindowRect SetProcessDpiAwarenessContext GetWindow MessageBoxW SendMessageW SetWindowPos CallWindowProcW GetKeyState DefWindowProcW GetMessageW GetWindowTextLengthW GetWindowThreadProcessId CreateWindowExW TrackPopupMenu GetWindowTextW EnableWindow GetCursorPos ReleaseDC InvalidateRect GetDpiForSystem LoadImageW SetForegroundWindow UpdateWindow DialogBoxParamW GetParent SetSystemCursor SystemParametersInfoW EnableMenuItem PostQuitMessage KillTimer SetWindowTextW CreatePopupMenu SetMenuItemBitmaps GetWindowLongPtrW RegisterClassExW WindowFromPoint GetActiveWindow ShowWindow IsWindow OpenClipboard DispatchMessageW SetTimer RedrawWindow IsDialogMessageW DestroyIcon ClientToScreen CloseClipboard EmptyClipboard SetWindowsHookExA SetDlgItemTextW SetWindowTextA GetDlgItemTextW SendDlgItemMessageW DialogBoxIndirectParamW MoveWindow UnhookWindowsHookEx DestroyMenu CreateWindowExA SetFocus BringWindowToTop SetPropW TranslateMessage LoadIconW FindWindowW LoadCursorW EnableNonClientDpiScaling InsertMenuW SetClipboardData SetCursor wsprintfW GetDlgItem AppendMenuW DrawIconEx

gdi32

DeleteObject CreateCompatibleDC CreateDIBSection SelectObject DeleteDC CreateFontW

advapi32

FreeSid LookupPrivilegeValueW AdjustTokenPrivileges CreateServiceW RegCloseKey QueryServiceStatus CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid SetEntriesInAclW RegDeleteKeyValueW RegCreateKeyExW SetNamedSecurityInfoW RegQueryValueExW QueryServiceStatusEx DuplicateTokenEx OpenServiceW RegOpenKeyExW StartServiceW ControlService OpenProcessToken RegSetValueExW CreateProcessWithTokenW DeleteService

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shlwapi

PathRemoveFileSpecW PathFileExistsW

dbghelp

SymGetModuleBase64 SymGetModuleInfo64 SymFromAddr SymSetOptions StackWalk64 SymLoadModuleExW SymInitialize SymFunctionTableAccess64 SymLoadModuleEx

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDecrypt

ntdll

NtQueryInformationProcess

Name

.text

Size

363KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

450KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_f36010582d20cfd4020b44dbfe4e3e82_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

PE Signature issue

comctl32

comdlg32

shell32

kernel32

user32

gdi32

advapi32

ole32

shlwapi

dbghelp

bcrypt

ntdll

generic