2026-08-09_ba636a4f479c067d954242e522ecdc1d_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_ba636a4f479c067d954242e522ecdc1d_cobalt-strike_glassworm_icedid_njrat_satacom
Size 16.9MB
Sample260809-x9jpbsvaqd
SHA256 2b959e88838d62db510dbd19528ab1321f34a3cd8cc300090b67c827655a2193
MD5 ba636a4f479c067d954242e522ecdc1d
SHA1 de11f332c91addf77d638f48f28dada8eba0c191
SHA512 3b053233a112f1df18d064ae7f65d4e53d03436525c3338c1e3f5b85db439c82aafe92f887aa7cd37c73964b7651177ff3b7260e19259e4806c994274698720e
SSDEEP 196608:bnMwI0AMncBghlnwkG+4JKuchUewTNCjXHG7:6McBgnwv+44uch0TaX+
TLSH
T16C071A5DAC570EEDF9CE9F286CAD72071C27BAB6152947BF49EC09A5032A6400FC7187
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_ba636a4f479c067d954242e522ecdc1d_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-08-09_ba636a4f479c067d954242e522ecdc1d_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 16.9MB

2026-08-09_ba636a4f479c067d954242e522ecdc1d_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH a85262b1ae2d61257b974ac40540d3b7
SHA256 2b959e88838d62db510dbd19528ab1321f34a3cd8cc300090b67c827655a2193
MD5 ba636a4f479c067d954242e522ecdc1d
SHA1 de11f332c91addf77d638f48f28dada8eba0c191
SHA512 3b053233a112f1df18d064ae7f65d4e53d03436525c3338c1e3f5b85db439c82aafe92f887aa7cd37c73964b7651177ff3b7260e19259e4806c994274698720e
SSDEEP 196608:bnMwI0AMncBghlnwkG+4JKuchUewTNCjXHG7:6McBgnwv+44uch0TaX+
TLSH
T16C071A5DAC570EEDF9CE9F286CAD72071C27BAB6152947BF49EC09A5032A6400FC7187
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17650176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11CreateTextureFromMemory

kernel32

GetSystemTimeAsFileTime CloseHandle MoveFileA VirtualProtect TerminateProcess Thread32Next Thread32First WaitForSingleObject OpenProcess Sleep GetLastError MoveFileExA CreateFileA DeleteFileA VirtualFree GetCurrentProcessId Process32FirstW GetModuleHandleW QueryFullProcessImageNameW CreateProcessA CreateDirectoryA OpenThread GetExitCodeProcess WriteFile ReadFile GetWindowsDirectoryA GetFileSize LoadLibraryW SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable GetStartupInfoW InitializeSListHead SetUnhandledExceptionFilter QueryPerformanceCounter FreeLibrary K32GetModuleInformation Process32NextW CreateToolhelp32Snapshot VirtualAlloc GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetCurrentProcess AcquireSRWLockExclusive ReleaseSRWLockExclusive GetThreadContext

user32

DefWindowProcW GetWindowRect DestroyWindow SetWindowLongPtrW SetWindowRgn CreateWindowExW EmptyClipboard GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow DispatchMessageW PeekMessageW MessageBoxA GetClipboardData SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow EnumWindows SetWinEventHook UnhookWinEvent GetWindowThreadProcessId PostMessageA FindWindowW UnhookWindowsHookEx SetWindowsHookExW PostThreadMessageW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen MoveWindow TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetCursor GetClientRect SetClipboardData

gdi32

CreateRoundRectRgn

advapi32

RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegCloseKey

shell32

ShellExecuteW SHGetFolderPathA

msvcp140

_Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?always_noconv@codecvt_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptEncrypt BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptImportKey BCryptDecrypt BCryptGetProperty BCryptDestroyKey

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr __C_specific_handler memcpy memmove memset __current_exception __current_exception_context _CxxThrowException strchr memcmp strstr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fsetpos _popen _set_fmode fgets _pclose _fseeki64 ungetc setvbuf fgetpos fgetc fputc __p__commode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell _get_stream_buffer_pointers

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _initterm_e _configure_narrow_argv _crt_atexit _errno _cexit _seh_filter_exe _initterm _set_app_type _exit _c_exit _get_narrow_winmain_command_line exit _wassert terminate _beginthreadex _register_thread_local_exe_atexit_callback system

api-ms-win-crt-string-l1-1-0

wcscmp strncpy strcat_s strncmp wcslen strlen strcmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

strtoull strtol

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64 clock

api-ms-win-crt-math-l1-1-0

cosf ceilf acosf powf __setusermatherr fmodf sqrtf sqrt sinf cos expf tan sin

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

275KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.opsec

Size

512B

Virtual Size

46B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

172KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_ba636a4f479c067d954242e522ecdc1d_cobalt-strike_glassworm_icedid_njrat_satacom

d3d11

d3dcompiler_43

d3dx11_43

kernel32

user32

gdi32

advapi32

shell32

msvcp140

imm32

dwmapi

bcrypt

winhttp

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic