2026-08-13_ee103748c5f7942ff7d5c4b65c50b627_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_ee103748c5f7942ff7d5c4b65c50b627_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 1.2MB
Sample260813-devzbsak3y
SHA256 a266fedb77ee798221c512331f704009cab3a93d26ea3e50840c9b492e0fa39d
MD5 ee103748c5f7942ff7d5c4b65c50b627
SHA1 d81687bd07d9a9c0c26c443f07f9c8681c021c89
SHA512 c8b5531a534155655107de0b7d1f0ca3ca2667f4575870a1bf152e99b50d87165796860a2caf0a582455ff891cf0b02e7cf5222dcd97cfa4e5b6b7c35e05cb43
SSDEEP 24576:zj+vdUBuUYAQBgrVbngsqjnhMgeiCl7G0nehbGZpbD:/+vdKzYpBcVbncDmg27RnWGj
TLSH
T1FF45E0AAB3A887F9D86BC03CC9574106F7B2B864075187CB17A4436E5F336D61E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_ee103748c5f7942ff7d5c4b65c50b627_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-13_ee103748c5f7942ff7d5c4b65c50b627_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 1.2MB

2026-08-13_ee103748c5f7942ff7d5c4b65c50b627_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH fa17bf6d0eb6b4a5a356c07f2127b232
SHA256 a266fedb77ee798221c512331f704009cab3a93d26ea3e50840c9b492e0fa39d
MD5 ee103748c5f7942ff7d5c4b65c50b627
SHA1 d81687bd07d9a9c0c26c443f07f9c8681c021c89
SHA512 c8b5531a534155655107de0b7d1f0ca3ca2667f4575870a1bf152e99b50d87165796860a2caf0a582455ff891cf0b02e7cf5222dcd97cfa4e5b6b7c35e05cb43
SSDEEP 24576:zj+vdUBuUYAQBgrVbngsqjnhMgeiCl7G0nehbGZpbD:/+vdKzYpBcVbncDmg27RnWGj
TLSH
T1FF45E0AAB3A887F9D86BC03CC9574106F7B2B864075187CB17A4436E5F336D61E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\BWA\C950AF1B-8B4B-0\iTunesWin-1200.12.10.11.2\srcroot\iTunes\iPodSupport\(Win32)\BuildResults\Production64\bin\iPodService.pdb

cfgmgr32

CM_Get_Parent CM_Get_DevNode_Status CM_Get_Device_ID_Size CM_Get_Device_IDA CM_Setup_DevNode CM_Query_And_Remove_SubTreeW CMP_WaitNoPendingInstallEvents

setupapi

SetupDiSetClassInstallParamsA SetupDiGetDeviceInstallParamsA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces

rpcrt4

UuidCompare UuidFromStringW

kernel32

SetEvent WaitForSingleObject CreateEventA Sleep WaitForMultipleObjects GetCurrentProcess CreateThread GetCurrentThread lstrcpyA CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection OpenEventA TerminateThread GetExitCodeThread CreateFileA DeviceIoControl GetOverlappedResult LoadLibraryA GetFileSize ReadFile GetVolumeInformationA GetTickCount GetTimeZoneInformation FlushFileBuffers WriteFile TryEnterCriticalSection GetFileAttributesA GetLogicalDrives GetDiskFreeSpaceExA GetFileAttributesExA InitializeCriticalSectionAndSpinCount GetLogicalDriveStringsA CreateFileW SetFilePointer GetModuleFileNameW CopyFileW ReleaseSemaphore CreateSemaphoreA VerSetConditionMask HeapSetInformation LoadLibraryW VerifyVersionInfoA LocalFree WriteConsoleW GetConsoleMode GetConsoleCP SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetCPInfo GetFileType IsDBCSLeadByte WideCharToMultiByte MultiByteToWideChar SetDllDirectoryA FindResourceA lstrcmpiA SizeofResource LoadResource LoadLibraryExA GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA FreeLibrary GetCurrentThreadId CreateMutexA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetErrorMode GetLastError RaiseException CloseHandle DecodePointer GetCommandLineA LCMapStringW CompareStringW HeapReAlloc HeapSize HeapAlloc HeapFree GetStdHandle ExitProcess OutputDebugStringA GetLocalTime GetModuleHandleExW FreeLibraryAndExitThread ExitThread VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError RtlUnwindEx RtlPcToFileHeader OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime GetCurrentProcessId

user32

PostThreadMessageA CharUpperA CharNextA CharNextW LoadStringA GetMessageA TranslateMessage DispatchMessageA MessageBoxA wsprintfA SendMessageA RegisterDeviceNotificationA UnregisterDeviceNotification GetPropA SetPropA SetTimer DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA

advapi32

RegQueryValueExA SetSecurityDescriptorDacl DeregisterEventSource RegisterEventSourceA ReportEventA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegGetValueA RegQueryValueExW RegOpenKeyExW UnlockServiceDatabase QueryServiceStatusEx LockServiceDatabase ChangeServiceConfig2A SetSecurityDescriptorOwner SetSecurityDescriptorGroup IsValidSid GetTokenInformation GetLengthSid CopySid OpenThreadToken OpenProcessToken StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle RegSetValueExA RegEnumKeyExA RegQueryInfoKeyW RegQueryInfoKeyA RegOpenKeyExA InitializeSecurityDescriptor

ole32

IIDFromString CoInitializeSecurity CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringByteLen UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocString

Name

.text

Size

371KB

Virtual Size

370KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_ee103748c5f7942ff7d5c4b65c50b627_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

cfgmgr32

setupapi

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

generic