2026-08-11_ad8dbe86f083f76bedca66c661b92353_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_ad8dbe86f083f76bedca66c661b92353_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 1.5MB
Sample260811-c3c8rateke
SHA256 c3a3e7aac88e85a4645b21e599448bd1a18d3e58ffa61684e6f349eeed5f78b6
MD5 ad8dbe86f083f76bedca66c661b92353
SHA1 20e1ed0985521c7dd05162e48007712a56f4f0bf
SHA512 ed16c0a4db772415a2a7d4cb3021ff6d1cd077b1082eecf048fcec86e8b379197c327b33ba1878fa1424e97534f077435e67c687c48a1d86080e4623e588dc9a
SSDEEP 24576:FzgkoVhTvbvAPt2A5qYPp7Om45/8wU4acbphXGaCm8AdGy+bRywD:FxSvbvIRx7m1FbphWB8+lyw
TLSH
T1D3655B26665800ACE0B6D1F8DB165C13D771B84A0335AEEF47D069B31F176E88A7EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_ad8dbe86f083f76bedca66c661b92353_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-11_ad8dbe86f083f76bedca66c661b92353_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 1.5MB

2026-08-11_ad8dbe86f083f76bedca66c661b92353_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 4e43ff8c19d4012c2c04e56ac0355df4
SHA256 c3a3e7aac88e85a4645b21e599448bd1a18d3e58ffa61684e6f349eeed5f78b6
MD5 ad8dbe86f083f76bedca66c661b92353
SHA1 20e1ed0985521c7dd05162e48007712a56f4f0bf
SHA512 ed16c0a4db772415a2a7d4cb3021ff6d1cd077b1082eecf048fcec86e8b379197c327b33ba1878fa1424e97534f077435e67c687c48a1d86080e4623e588dc9a
SSDEEP 24576:FzgkoVhTvbvAPt2A5qYPp7Om45/8wU4acbphXGaCm8AdGy+bRywD:FxSvbvIRx7m1FbphWB8+lyw
TLSH
T1D3655B26665800ACE0B6D1F8DB165C13D771B84A0335AEEF47D069B31F176E88A7EF12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding command execution via IExecuteCommand COM object
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1499136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetSystemTime GetSystemTimeAsFileTime GetLocalTime GetTickCount GetTickCount64 GetSystemDirectoryA GetWindowsDirectoryA VirtualQueryEx ReadProcessMemory FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA GetLogicalDriveStringsA QueryFullProcessImageNameA FindResourceA QueryDosDeviceA CopyFileA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime OpenFileById MultiByteToWideChar WideCharToMultiByte GetConsoleMode SetConsoleMode SetConsoleCP SetConsoleOutputCP GetConsoleCursorInfo SetConsoleCursorInfo SetConsoleScreenBufferSize SetConsoleWindowInfo SetConsoleTitleA SetCurrentConsoleFontEx CreateToolhelp32Snapshot Process32First Process32Next Thread32First GetSystemInfo Module32First Module32Next SetEndOfFile OpenProcess GetProcessId CreateProcessA OpenThread GetExitCodeProcess TerminateProcess GetCurrentProcessId GetCurrentProcess GetProcessTimes Sleep WaitForSingleObject DeviceIoControl GetLastError DuplicateHandle CloseHandle CheckRemoteDebuggerPresent IsDebuggerPresent GetTempPathA WriteFile SetFilePointerEx ReadFile GetLogicalDrives GetFinalPathNameByHandleA GetFileSize GetFileAttributesExA WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc GetOEMCP GetACP IsValidCodePage PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents GetTimeZoneInformation ReadConsoleW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW GetStdHandle GetFileAttributesA GetDriveTypeA GetDiskFreeSpaceExA FindNextFileA FindFirstFileA FindClose DeleteFileA CreateFileW CreateFileA GetCurrentDirectoryA VirtualProtect CreateProcessW HeapFree HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExpandEnvironmentStringsA GetEnvironmentVariableA Thread32Next LocalFree FormatMessageA GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP IsProcessorFeaturePresent ExitProcess GetModuleFileNameW RtlUnwind

advapi32

CryptAcquireContextA AdjustTokenPrivileges GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupPrivilegeValueA RegCloseKey RegEnumKeyExA RegEnumValueA RegEnumValueW RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegGetValueA CloseServiceHandle CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext OpenProcessToken QueryServiceStatusEx QueryServiceStatus OpenServiceA OpenSCManagerA

user32

EnumDesktopWindows EnumWindows GetClassNameA EnumDesktopsW OpenDesktopW CloseDesktop GetProcessWindowStation IsWindow GetWindowDisplayAffinity GetWindowTextA GetWindowThreadProcessId EnumChildWindows

shell32

SHGetFolderPathA SHCreateDirectoryExA

psapi

EnumProcesses EnumProcessModules EnumProcessModulesEx GetModuleBaseNameA GetModuleFileNameExA GetModuleFileNameExW GetModuleInformation EnumDeviceDrivers GetDeviceDriverBaseNameA GetDeviceDriverFileNameA

dbghelp

MiniDumpWriteDump

wintrust

WinVerifyTrust

crypt32

CryptMsgGetParam CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertCompareCertificateName CertGetNameStringA CryptQueryObject CryptMsgClose

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

ws2_32

getnameinfo WSACleanup WSAStartup ntohs inet_pton inet_ntop

iphlpapi

GetExtendedUdpTable GetExtendedTcpTable

Name

.text

Size

982KB

Virtual Size

982KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

199KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

124KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_ad8dbe86f083f76bedca66c661b92353_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

advapi32

user32

shell32

psapi

dbghelp

wintrust

crypt32

version

ws2_32

iphlpapi

generic