2026-08-16_adcae238a5eb333baee85a7a4c35692f_cobalt-strike_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_adcae238a5eb333baee85a7a4c35692f_cobalt-strike_glassworm_icedid_njrat
Size 16.4MB
Sample260816-egynnsygpg
SHA256 046707f7e77267076da5b9e0079a315309245025f81a4faef5b123acc29822e7
MD5 adcae238a5eb333baee85a7a4c35692f
SHA1 29fbb5cd258486a844f37a6821e4e2e54363e15b
SHA512 af6e8c8b7dd3e488d63fe3c88be6cffcdfeaa2d8e4033f52376a50edb3ca680766f6d730289baf1d65e47851eec9924bd7e61db3a629c64eb9aa0de13416c28f
SSDEEP 393216:ldTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggN:TRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T1DB075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_adcae238a5eb333baee85a7a4c35692f_cobalt-strike_glassworm_icedid_njrat

File Explorer

2026-08-16_adcae238a5eb333baee85a7a4c35692f_cobalt-strike_glassworm_icedid_njrat

.exe 16.4MB

2026-08-16_adcae238a5eb333baee85a7a4c35692f_cobalt-strike_glassworm_icedid_njrat

IMPHASH 3f8598ffe56eda61b40e2aa98e11b949
SHA256 046707f7e77267076da5b9e0079a315309245025f81a4faef5b123acc29822e7
MD5 adcae238a5eb333baee85a7a4c35692f
SHA1 29fbb5cd258486a844f37a6821e4e2e54363e15b
SHA512 af6e8c8b7dd3e488d63fe3c88be6cffcdfeaa2d8e4033f52376a50edb3ca680766f6d730289baf1d65e47851eec9924bd7e61db3a629c64eb9aa0de13416c28f
SSDEEP 393216:ldTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggN:TRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T1DB075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17168384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dbghelp

StackWalk64 SymInitialize SymGetOptions SymSetOptions SymGetModuleBase64 SymFunctionTableAccess64 SymFromAddr

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSendRequest WinHttpSetCredentials WinHttpQueryHeaders WinHttpOpenRequest

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegGetValueA RegSetKeyValueW SystemFunction036

kernel32

GetOEMCP GetACP IsValidCodePage FlushFileBuffers HeapQueryInformation HeapSize GetCurrentDirectoryW GetTimeZoneInformation GetConsoleOutputCP ReadConsoleW GetConsoleMode HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW SetCurrentDirectoryW GetNamedPipeInfo GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileAttributesW LocalFree MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent VirtualProtect GetCurrentThreadStackLimits InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce CreateDirectoryW DeleteFileW RemoveDirectoryW GetLastError GetModuleFileNameW GetCurrentProcess TerminateProcess QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 CloseHandle GetCurrentProcessId VirtualQuery FreeLibrary LoadLibraryExW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCurrentThread GetThreadId GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LoadLibraryA RaiseException DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObject CreateThread GetModuleHandleA GetModuleFileNameA RtlCaptureStackBackTrace CreateFileW LockFileEx SetEndOfFile UnlockFileEx CreateProcessW GetStdHandle GetFileType SetUnhandledExceptionFilter AddVectoredExceptionHandler SetEvent SleepEx CreateEventW Sleep GetCurrentThreadId GetExitCodeThread FlushInstructionCache OpenProcess GetVersion VirtualAllocEx VirtualProtectEx WriteProcessMemory WerRegisterRuntimeExceptionModule RemoveVectoredExceptionHandler GetFileSizeEx ReadFile SetFilePointerEx WriteFile RtlUnwind FindFirstFileExW GetFileTime MoveFileExW LoadLibraryW FormatMessageA DuplicateHandle GetSystemInfo VirtualQueryEx ReadProcessMemory SetLastError SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW OutputDebugStringW GetLocalTime FormatMessageW InitializeCriticalSectionAndSpinCount TryEnterCriticalSection IsValidLocale GetLocaleInfoW LCMapStringW VirtualAlloc VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable WaitForSingleObjectEx SwitchToThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetSystemTimePreciseAsFileTime InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW GetStartupInfoW InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetDriveTypeW GetFullPathNameW IsProcessorFeaturePresent GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetCommandLineA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapAlloc HeapFree GetTempPathW IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW

shell32

CommandLineToArgvW

Name

.text

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

631KB

Virtual Size

630KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

323B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

111KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_adcae238a5eb333baee85a7a4c35692f_cobalt-strike_glassworm_icedid_njrat

dbghelp

version

winhttp

advapi32

kernel32

shell32

generic