General
- Target 2026-08-10_f4c38084d63c91570e7fd71137a105b2_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- Sample260810-3ca9ksbb62
- SHA256 f8ef893aad7a5025fc1fedb4d7fc4953e0dbdd215dc0cb15a3384a5789ad21b6
- MD5 f4c38084d63c91570e7fd71137a105b2
- SHA1 e1b3ddb3ba82608284896d669a52c0fe3d5713ef
- SHA512 a721cca9b2e52d307872e2adb2044360a075c8c20d2691f558cd974529c36b8e1222dd0de7596df93230dced7c62ba01d8d7e1d621916f5ea385c2d75ef804d2
- SSDEEP 98304:XSpbOrf4DgU6vBELOnTWPBx6wR9QKiKkKURgyLjR+gEiWyssUhVl7wRGpj3:CZOr1WoWnRXQRpEqsFhfF9
- TLSH T193A67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_f4c38084d63c91570e7fd71137a105b2_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_f4c38084d63c91570e7fd71137a105b2_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- SHA256 f8ef893aad7a5025fc1fedb4d7fc4953e0dbdd215dc0cb15a3384a5789ad21b6
- MD5 f4c38084d63c91570e7fd71137a105b2
- SHA1 e1b3ddb3ba82608284896d669a52c0fe3d5713ef
- SHA512 a721cca9b2e52d307872e2adb2044360a075c8c20d2691f558cd974529c36b8e1222dd0de7596df93230dced7c62ba01d8d7e1d621916f5ea385c2d75ef804d2
- SSDEEP 98304:XSpbOrf4DgU6vBELOnTWPBx6wR9QKiKkKURgyLjR+gEiWyssUhVl7wRGpj3:CZOr1WoWnRXQRpEqsFhfF9
- TLSH T193A67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1