General
- Target 2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.7MB
- Sample260809-vb9rravwhv
- SHA256 28198b122b37a5f038975473a26fd4f84066eddca4778f5123792064f19ad112
- MD5 5335621a1c3fac5bac5c5ed065224d5e
- SHA1 78561ac8e5890393e2eba09b808202113d332144
- SHA512 c3fb44d406788c5ffd7bd62c0a0d3f0d9992b7000fd6d2e8f8dbaae0814607f04be97f3f0cace209e792a4c126f39d08867d8479cdacfdeeb995081e8afbc089
- SSDEEP 98304:PaytBxqFVdaUoNVaGa+1z4XNqq5tP7bnAyhVXtfZOfDT:PBeV4kNl5lnhLfMf
- TLSH T1E9A66B13F29901D8E06ED5788B6A5232A972BC8A4B30B2DF3A5C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_5335621a1c3fac5bac5c5ed065224d5e_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.7MB
- SHA256 28198b122b37a5f038975473a26fd4f84066eddca4778f5123792064f19ad112
- MD5 5335621a1c3fac5bac5c5ed065224d5e
- SHA1 78561ac8e5890393e2eba09b808202113d332144
- SHA512 c3fb44d406788c5ffd7bd62c0a0d3f0d9992b7000fd6d2e8f8dbaae0814607f04be97f3f0cace209e792a4c126f39d08867d8479cdacfdeeb995081e8afbc089
- SSDEEP 98304:PaytBxqFVdaUoNVaGa+1z4XNqq5tP7bnAyhVXtfZOfDT:PBeV4kNl5lnhLfMf
- TLSH T1E9A66B13F29901D8E06ED5788B6A5232A972BC8A4B30B2DF3A5C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1