2026-08-10_3c22be6004282f1cc28f71e3b1115d90_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_3c22be6004282f1cc28f71e3b1115d90_cobalt-strike_glassworm_icedid_njrat_satacom
Size 74.3MB
Sample260810-mprjbsxanf
SHA256 6c8a3f9887ab4e01c68d041ad5152ef9f31eb0d644375cfce7f5a55935163ec6
MD5 3c22be6004282f1cc28f71e3b1115d90
SHA1 a69351120d60c28dd455e25ed7b82f253fb52858
SHA512 c89c83b466bc328b672162d370c83ee929a557fbe336e29fdbf0eafcb5f31bccf528ebefcc80d59e1c738b6f5cf6a4a83b9bb5a2056aa5435c8c6a3e8d6b11ce
SSDEEP 1572864:iTWmw3P3R8fNknAnZ2yOogqTcaNH21A/eCuK4hzLlSLlO:sA/h8fNknAnIdA7lxVr4hz
TLSH
T1DF083346A2878298EF67933A45424623DBB07CC843B0C6D79BDD4C712F672F5AA3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_3c22be6004282f1cc28f71e3b1115d90_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-08-10_3c22be6004282f1cc28f71e3b1115d90_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 74.3MB
dedsec_rat_obfuscated.pyc

61KB

2026-08-10_3c22be6004282f1cc28f71e3b1115d90_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH a31aab42c1d35bbc4b07d9674f87d92c
SHA256 6c8a3f9887ab4e01c68d041ad5152ef9f31eb0d644375cfce7f5a55935163ec6
MD5 3c22be6004282f1cc28f71e3b1115d90
SHA1 a69351120d60c28dd455e25ed7b82f253fb52858
SHA512 c89c83b466bc328b672162d370c83ee929a557fbe336e29fdbf0eafcb5f31bccf528ebefcc80d59e1c738b6f5cf6a4a83b9bb5a2056aa5435c8c6a3e8d6b11ce
SSDEEP 1572864:iTWmw3P3R8fNknAnZ2yOogqTcaNH21A/eCuK4hzLlSLlO:sA/h8fNknAnIdA7lxVr4hz
TLSH
T1DF083346A2878298EF67933A45424623DBB07CC843B0C6D79BDD4C712F672F5AA3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1161760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Usuário\Downloads\rocket\paste stopped internal\paste stopped internal\paste\Plus\x64\Release\magicPlus.pdb

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

CreateFile2 SetFileInformationByHandle GetFileAttributesExW GetCurrentProcess TerminateProcess GetExitCodeProcess WaitForSingleObject Sleep CloseHandle CreateRemoteThread OutputDebugStringA OpenProcess MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetVolumeInformationW FindFirstFileW GetFileSizeEx FindNextFileW lstrlenW WriteFile GetShortPathNameW RemoveDirectoryW GetModuleFileNameW SetFilePointer SetEndOfFile GetTempPathW GetEnvironmentVariableA FindClose CreateFileW GetLogicalDriveStringsW CreateToolhelp32Snapshot Process32NextW DeleteFileW Process32FirstW GetLastError GetCurrentProcessId CreateDirectoryA MoveFileW GetDriveTypeW GetComputerNameA FlushFileBuffers GetModuleHandleW WriteProcessMemory Module32FirstW VirtualAllocEx ReadProcessMemory Module32NextW VirtualFreeEx FindFirstFileA FindNextFileA CreateDirectoryW SizeofResource LockResource LoadResource FindResourceW GetFileInformationByHandleEx FindFirstFileExW GetLocaleInfoEx FormatMessageA LocalFree InitOnceBeginInitialize InitOnceComplete GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile CreateFileA InitializeSListHead WakeAllConditionVariable ExitProcess SetUnhandledExceptionFilter GetStartupInfoW GetWindowsDirectoryW GetSystemTimeAsFileTime

user32

GetWindowTextLengthW GetWindowThreadProcessId IsWindowUnicode GetWindowTextW DefWindowProcW CreateWindowExW GetSystemMetrics GetKeyState GetMessageExtraInfo ScreenToClient EnumWindows ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData IsIconic SetForegroundWindow GetClientRect SetWindowLongW TranslateMessage SetFocus MoveWindow GetForegroundWindow GetMonitorInfoA MapWindowPoints PeekMessageW DispatchMessageW GetAsyncKeyState GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor ShowWindow EnumDisplayMonitors SetWindowPos IsWindowVisible GetWindowLongW SetClipboardData

advapi32

RegDeleteTreeW

shell32

ShellExecuteExW SHGetFolderPathA SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteW

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ __crtLCMapStringA ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xbad_function_call@std@@YAXXZ _Thrd_id _Thrd_join _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ

ws2_32

socket ioctlsocket send WSAStartup listen closesocket bind accept WSAGetLastError recv setsockopt htons WSACleanup

winmm

timeBeginPeriod PlaySoundA timeEndPeriod

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

wininet

InternetQueryOptionW HttpOpenRequestA InternetCloseHandle InternetSetOptionW InternetConnectA HttpSendRequestA InternetOpenA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate __std_type_info_compare strchr __RTtypeid strstr strrchr longjmp memcpy memmove memset memchr memcmp __current_exception __current_exception_context __C_specific_handler __intrinsic_setjmp _CxxThrowException

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh realloc free

api-ms-win-crt-runtime-l1-1-0

abort _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _exit _initialize_onexit_table exit _initterm_e _initterm _get_wide_winmain_command_line terminate _beginthreadex _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _register_onexit_function _cexit _errno

api-ms-win-crt-math-l1-1-0

sinf powf __setusermatherr pow ceilf fmaxf _dsign atan2f logf acosf log fmodf floorf cosf sqrtf

api-ms-win-crt-convert-l1-1-0

atof strtoull strtod strtoul strtoll strtol

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_locale_name_func ___lc_collate_cp_func _configthreadlocale

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vsscanf _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc __stdio_common_vsprintf_s fclose fflush fputc __stdio_common_vsprintf

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy wcscat_s _wcsicmp toupper strcpy strlen wcslen

api-ms-win-crt-time-l1-1-0

_time64

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_3c22be6004282f1cc28f71e3b1115d90_cobalt-strike_glassworm_icedid_njrat_satacom

dwmapi

d3d11

d3dx11_43

kernel32

user32

advapi32

shell32

msvcp140

ws2_32

winmm

imm32

d3dcompiler_43

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

generic

dedsec_rat_obfuscated.pyc