2026-08-11_0649af6da0fe583bbb33459d471086fd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_0649af6da0fe583bbb33459d471086fd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 2.7MB
Sample260811-vvhsdat1ht
SHA256 dae9f7ea17b819ce23cd4761b4a2fd4b7129200ad33dd83caf83b3045741e67f
MD5 0649af6da0fe583bbb33459d471086fd
SHA1 25224e00f6ac63ff6da78222bba829558d4311b5
SHA512 dfff0a026c96f0e79ce7eccaf0ebc6509b0b15775c5a07ae6475d6bc04d3e37fcc3a2912df234e2e7c3a322436a9be13b07f04fc0f2b334e98ad1db83bd76ca5
SSDEEP 49152:L4czqj4EyqxCUaoonLDkLLf34ycZRm9MNgmQnLhTLNiXicJFFRGNzj3:KXf4bZ2h7wRGpj3
TLSH
T176D5080233F91B9DF2F38B78D576A6129876BC2D9B11D7EE2264400D1E22B908D75B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_0649af6da0fe583bbb33459d471086fd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-11_0649af6da0fe583bbb33459d471086fd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 2.7MB

2026-08-11_0649af6da0fe583bbb33459d471086fd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH b330b946f790ae5ed499d126edcf0220
SHA256 dae9f7ea17b819ce23cd4761b4a2fd4b7129200ad33dd83caf83b3045741e67f
MD5 0649af6da0fe583bbb33459d471086fd
SHA1 25224e00f6ac63ff6da78222bba829558d4311b5
SHA512 dfff0a026c96f0e79ce7eccaf0ebc6509b0b15775c5a07ae6475d6bc04d3e37fcc3a2912df234e2e7c3a322436a9be13b07f04fc0f2b334e98ad1db83bd76ca5
SSDEEP 49152:L4czqj4EyqxCUaoonLDkLLf34ycZRm9MNgmQnLhTLNiXicJFFRGNzj3:KXf4bZ2h7wRGpj3
TLSH
T176D5080233F91B9DF2F38B78D576A6129876BC2D9B11D7EE2264400D1E22B908D75B37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

707584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\dptf\Src\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\esif_uf.pdb

kernel32

HeapSize GetStringTypeW OutputDebugStringW SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentThreadId GetThreadId GetSystemPowerStatus GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WideCharToMultiByte GetTimeZoneInformation GetFileAttributesExW GetFileSizeEx SetFilePointerEx SetEndOfFile GetTickCount64 RaiseException OutputDebugStringA WaitForMultipleObjects WriteConsoleW GetConsoleOutputCP CreateFileA DeviceIoControl ReadConsoleW GetEnvironmentVariableA GetTempPathW FormatMessageA SetLastError CreateMutexA CreateMutexW SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW ReleaseMutex LocalFree GetStdHandle GetCommandLineW TerminateProcess GetExitCodeProcess ExitThread GetExitCodeThread CreateProcessW AddDllDirectory SetDllDirectoryW WriteConsoleInputW GetConsoleMode SetStdHandle GetFullPathNameW GetCurrentDirectoryW CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult LoadLibraryExA GetProcAddress GetModuleHandleExA FreeLibrary GetLastError AcquireSRWLockShared ReleaseSRWLockShared GetFileAttributesA FindNextFileA FindFirstFileA FindClose QueryPerformanceFrequency WTSGetActiveConsoleSessionId SetCurrentDirectoryW HeapReAlloc CreateDirectoryW DeleteFileW RemoveDirectoryW CopyFileW QueryPerformanceCounter CreateThread GetCurrentProcess CreateSemaphoreW Sleep CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock DuplicateHandle GetTempPathA MoveFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW TlsFree CloseHandle TlsSetValue TlsGetValue TlsAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent __C_specific_handler WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA HeapFree HeapAlloc GetCurrentThread MultiByteToWideChar InitializeCriticalSectionAndSpinCount RtlUnwind

powrprof

CallNtPowerInformation PowerReadACValueIndex SetSuspendState PowerRemovePowerSetting PowerWriteSettingAttributes PowerReadDCValueIndex

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer WindowsCreateStringReference WindowsCreateString WindowsCompareStringOrdinal WindowsDuplicateString WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoIncrementMTAUsage CoDecrementMTAUsage CoUninitialize PropVariantClear StringFromCLSID

api-ms-win-power-setting-l1-1-0

PowerGetActiveScheme PowerSetActiveScheme PowerSettingRegisterNotification PowerWriteDCValueIndex PowerSettingUnregisterNotification PowerWriteACValueIndex

advapi32

EventWrite EventUnregister EventRegister StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W SetTokenInformation DuplicateTokenEx CreateProcessAsUserW ConvertStringSidToSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce AddAccessAllowedAce LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken ControlTraceW CloseTrace ProcessTrace OpenTraceW EnableTraceEx StartTraceW

tdh

TdhGetEventInformation

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

setupapi

CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_DevNode_Registry_PropertyW CM_Locate_DevNodeW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

907KB

Virtual Size

906KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_0649af6da0fe583bbb33459d471086fd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

kernel32

powrprof

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

ole32

api-ms-win-power-setting-l1-1-0

advapi32

tdh

userenv

setupapi

generic