2026-08-09_8710742980155bdd04bc7595c61753e0_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_8710742980155bdd04bc7595c61753e0_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 1.2MB
Sample260809-regzcsgk2w
SHA256 f978f4ac9e7429646f0732a6a92ae9be8b26e05b0acfcbf6a84c3161548e48a2
MD5 8710742980155bdd04bc7595c61753e0
SHA1 4726c597460c619109c894ec79be87e7debd7e7f
SHA512 9234e3d1b166f6a31b2893efc5a159cd894e88605cdbddb2dfbd0b675fe120d135e0cf199a1c0f2ae4126f2b68cde72540688014fd61203ee6784a708810e76e
SSDEEP 24576:Su3sgsnLdd/AnH6X5pq5NyBo4kx929bL3Hnx:Su8gc5JuH25pq+B+kn3Hnx
TLSH
T1F445D0AAB3A887F9E46BC03CC9174506F6B2B858075197CB13A4436E5F337D61E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_8710742980155bdd04bc7595c61753e0_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-09_8710742980155bdd04bc7595c61753e0_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 1.2MB

2026-08-09_8710742980155bdd04bc7595c61753e0_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 9691aacbd1408eeda1d1355f05399170
SHA256 f978f4ac9e7429646f0732a6a92ae9be8b26e05b0acfcbf6a84c3161548e48a2
MD5 8710742980155bdd04bc7595c61753e0
SHA1 4726c597460c619109c894ec79be87e7debd7e7f
SHA512 9234e3d1b166f6a31b2893efc5a159cd894e88605cdbddb2dfbd0b675fe120d135e0cf199a1c0f2ae4126f2b68cde72540688014fd61203ee6784a708810e76e
SSDEEP 24576:Su3sgsnLdd/AnH6X5pq5NyBo4kx929bL3Hnx:Su8gc5JuH25pq+B+kn3Hnx
TLSH
T1F445D0AAB3A887F9E46BC03CC9174506F6B2B858075197CB13A4436E5F337D61E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BWA\82CC4D57-E68E-0\iTunesWin-1200.12.11.3.7\srcroot\iTunes\iPodSupport\(Win32)\BuildResults\Production64\bin\iPodService.pdb

cfgmgr32

CM_Get_Parent CM_Get_DevNode_Status CM_Get_Device_ID_Size CM_Get_Device_IDA CM_Setup_DevNode CM_Query_And_Remove_SubTreeW CMP_WaitNoPendingInstallEvents

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceInstallParamsA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo

rpcrt4

UuidFromStringW UuidCompare

kernel32

SetEvent WaitForSingleObject CreateEventA Sleep WaitForMultipleObjects GetCurrentProcess CreateThread GetCurrentThread lstrcpyA CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection OpenEventA TerminateThread GetExitCodeThread CreateFileA DeviceIoControl GetOverlappedResult LoadLibraryA GetFileSize ReadFile GetVolumeInformationA GetTickCount GetTimeZoneInformation FlushFileBuffers WriteFile TryEnterCriticalSection GetFileAttributesA GetLogicalDrives GetDiskFreeSpaceExA GetFileAttributesExA InitializeCriticalSectionAndSpinCount GetLogicalDriveStringsA CreateFileW SetFilePointer GetModuleFileNameW CopyFileW ReleaseSemaphore CreateSemaphoreA VerSetConditionMask HeapSetInformation LoadLibraryW VerifyVersionInfoA LocalFree WriteConsoleW GetConsoleMode GetConsoleCP SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetCPInfo GetFileType IsDBCSLeadByte WideCharToMultiByte MultiByteToWideChar SetDllDirectoryA FindResourceA lstrcmpiA SizeofResource LoadResource LoadLibraryExA GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA FreeLibrary GetCurrentThreadId CreateMutexA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetErrorMode GetLastError RaiseException CloseHandle DecodePointer GetCommandLineA LCMapStringW CompareStringW HeapReAlloc HeapSize HeapAlloc HeapFree GetStdHandle ExitProcess OutputDebugStringA GetLocalTime GetModuleHandleExW FreeLibraryAndExitThread ExitThread VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError RtlUnwindEx RtlPcToFileHeader OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime GetCurrentProcessId

user32

CharNextW MessageBoxA GetMessageA TranslateMessage CharNextA wsprintfA SendMessageA RegisterDeviceNotificationA CharUpperA PostThreadMessageA DispatchMessageA DestroyWindow UnregisterDeviceNotification GetPropA SetPropA SetTimer DefWindowProcA CreateWindowExA RegisterClassA PostQuitMessage LoadStringA

advapi32

RegSetValueExA SetSecurityDescriptorDacl DeregisterEventSource RegisterEventSourceA ReportEventA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegGetValueA RegQueryValueExW RegOpenKeyExW UnlockServiceDatabase QueryServiceStatusEx LockServiceDatabase ChangeServiceConfig2A SetSecurityDescriptorOwner SetSecurityDescriptorGroup IsValidSid GetTokenInformation GetLengthSid CopySid OpenThreadToken OpenProcessToken StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle RegEnumKeyExA RegQueryValueExA RegQueryInfoKeyW RegQueryInfoKeyA RegOpenKeyExA InitializeSecurityDescriptor

ole32

IIDFromString CoInitializeSecurity CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoUninitialize CoTaskMemRealloc CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoInitializeEx

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringByteLen UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarUI4FromStr

Name

.text

Size

370KB

Virtual Size

370KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_8710742980155bdd04bc7595c61753e0_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

cfgmgr32

setupapi

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

generic