2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar
Size 1.9MB
Sample260816-ftmydabd49
SHA256 5ea2c1bfad6057ca801caac8c305788797da6258b355547f8e73171381d698bd
MD5 0ad4bf779a11b5eaced26621f1f9e24a
SHA1 3d14835e9c0a07dfd5c8e570abca6fc67db08d72
SHA512 61b311436b09abe1aacd70b3557e35159ab9a2450acaf6278bb0428689dce28424cc1d3aafe43638ba6757628958b285babf01c6cad5ecd1d90bdf78e6c70ca2
SSDEEP 24576:PfKxxbuMOeLW61nf2+m/oxz/y/N9w/XYwUFzz:XKDuMOs5n+FgUFX
TLSH
T1C5954A296E541DDCD06A843DCB838A8ED2B1BC1A1F718BD717A17BA72E321D01E3B751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH 48a46e0f0aaac5a8629aa31dad71ab5d
SHA256 5ea2c1bfad6057ca801caac8c305788797da6258b355547f8e73171381d698bd
MD5 0ad4bf779a11b5eaced26621f1f9e24a
SHA1 3d14835e9c0a07dfd5c8e570abca6fc67db08d72
SHA512 61b311436b09abe1aacd70b3557e35159ab9a2450acaf6278bb0428689dce28424cc1d3aafe43638ba6757628958b285babf01c6cad5ecd1d90bdf78e6c70ca2
SSDEEP 24576:PfKxxbuMOeLW61nf2+m/oxz/y/N9w/XYwUFzz:XKDuMOs5n+FgUFX
TLSH
T1C5954A296E541DDCD06A843DCB838A8ED2B1BC1A1F718BD717A17BA72E321D01E3B751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1830912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle

user32

SetWindowTextW EndDialog SendMessageW UnionRect GetIconInfo GetWindowLongA AdjustWindowRect CreateIconFromResourceEx SetForegroundWindow DialogBoxParamA SetWindowPos OffsetRect SendDlgItemMessageA GetDlgItem InflateRect LookupIconIdFromDirectoryEx LoadImageA

kernel32

GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetModuleHandleExW ExitProcess GetConsoleMode GetConsoleOutputCP GetFileType SetStdHandle SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx MultiByteToWideChar GetLastError QueryPerformanceFrequency QueryPerformanceCounter ReadFile GetFileSizeEx WriteFile SetEndOfFile WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId ResumeThread CreateEventW FormatMessageW SetEvent WaitForSingleObjectEx TlsAlloc CloseHandle LoadLibraryW CreateThread SwitchToThread GetProcAddress SetFilePointerEx FreeLibrary TlsFree IsDebuggerPresent FlushFileBuffers SizeofResource FindFirstFileW EnterCriticalSection GetCommandLineW WriteConsoleW GetCurrentProcess TerminateProcess EnumResourceNamesA SetEnvironmentVariableW InitializeCriticalSection SetErrorMode SetFilePointer FindResourceA FindClose UnmapViewOfFile GetModuleHandleA GetExitCodeThread TerminateThread LoadLibraryA LockResource DeleteFileW LoadResource CreateFileMappingA GetFileSize DeleteCriticalSection ReadProcessMemory GetCurrentProcessId CreateProcessW CopyFileW WideCharToMultiByte CreateEventA MapViewOfFile LoadLibraryExW GetStdHandle GetProcessId GetTempPathW WaitForMultipleObjectsEx OpenProcess Sleep GetThreadId GetSystemTimeAsFileTime GetSystemTime CopyFileExW AllocConsole GetExitCodeProcess CreateDirectoryW FindFirstFileExW TlsSetValue GetFullPathNameW RemoveDirectoryW SetFileTime GetModuleFileNameW SetFileAttributesW GetFileAttributesExW GetDiskFreeSpaceExW MoveFileExW ReplaceFileW SystemTimeToFileTime GetModuleHandleW TlsGetValue GetTempFileNameW HeapFree Thread32Next Thread32First SuspendThread CreateToolhelp32Snapshot HeapAlloc LocalFree VerSetConditionMask GetProcessHeap VerifyVersionInfoW OpenThread GetModuleFileNameA SetWaitableTimer SetLastError RtlCaptureContext OutputDebugStringA RtlVirtualUnwind RtlLookupFunctionEntry GetEnvironmentVariableA GetCurrentDirectoryA GetFileAttributesA GetCurrentThread GetThreadContext SleepEx CreateWaitableTimerExW GetStringTypeW TryAcquireSRWLockExclusive InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FreeEnvironmentStringsW LeaveCriticalSection FindNextFileW RtlUnwind

dbghelp

SymLoadModuleEx ImageDirectoryEntryToDataEx SymRegisterFunctionEntryCallback64

shell32

CommandLineToArgvW SHGetKnownFolderPath SHFileOperationW SHCreateDirectoryExW

ole32

CoInitializeEx CoTaskMemFree CoCreateGuid

shlwapi

PathCanonicalizeW

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

InternetCloseHandle InternetOpenA InternetCrackUrlA HttpOpenRequestA HttpQueryInfoA InternetConnectA HttpSendRequestA

gdi32

GetObjectA

bcrypt

BCryptCloseAlgorithmProvider BCryptDeriveKeyPBKDF2 BCryptOpenAlgorithmProvider

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

Name

.text

Size

546KB

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

855KB

Virtual Size

855KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcdf17

Size

316KB

Virtual Size

508KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

api-ms-win-core-synch-l1-2-0

user32

kernel32

dbghelp

shell32

ole32

shlwapi

psapi

advapi32

wininet

gdi32

bcrypt

version

generic