2026-08-18_7aeb3de217c419f931685b56d3f0829b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_7aeb3de217c419f931685b56d3f0829b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 784KB
Sample260818-cj7y1scp21
SHA256 130297ec4f24acfa240dbea1d1bf5b5120075de352077324dccf59726ade965d
MD5 7aeb3de217c419f931685b56d3f0829b
SHA1 b131fe90a4c40d6bffea0c577578c1139e3da0bf
SHA512 0e507b634dd8efe1ec9abf17306da8acd002207c5f826156814c11f25c896b6a0bb96a0d49600c3cbc00b44d6412ce89656fa83d4d98c1112716f29bf82a9ab7
SSDEEP 12288:qj1dXh8zhGjJLTEV3NTyfBNgiHokKwr9pIY/fKaJ:qjTxG6TmGBNgiIkKu9i
TLSH
T1BA057B187FAC8999E152153D854E0605DBAAE4F217327387330AEF621D069DDEE3C3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_7aeb3de217c419f931685b56d3f0829b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-18_7aeb3de217c419f931685b56d3f0829b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 784KB

2026-08-18_7aeb3de217c419f931685b56d3f0829b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH c4d6d6d947a6c780ecc35f1c0bb890dd
SHA256 130297ec4f24acfa240dbea1d1bf5b5120075de352077324dccf59726ade965d
MD5 7aeb3de217c419f931685b56d3f0829b
SHA1 b131fe90a4c40d6bffea0c577578c1139e3da0bf
SHA512 0e507b634dd8efe1ec9abf17306da8acd002207c5f826156814c11f25c896b6a0bb96a0d49600c3cbc00b44d6412ce89656fa83d4d98c1112716f29bf82a9ab7
SSDEEP 12288:qj1dXh8zhGjJLTEV3NTyfBNgiHokKwr9pIY/fKaJ:qjTxG6TmGBNgiIkKu9i
TLSH
T1BA057B187FAC8999E152153D854E0605DBAAE4F217327387330AEF621D069DDEE3C3E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mscoree

CLRCreateInstance

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx

oleaut32

SysAllocString VariantClear VariantInit SafeArrayCreateVector SafeArrayPutElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayDestroy SafeArrayCreate SysFreeString

kernel32

WriteConsoleW CreateFileW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx RtlAddFunctionTable GetCommandLineW CloseHandle WaitForSingleObject CreateThread VirtualAlloc VirtualProtect VirtualFree GetProcAddress LoadLibraryA LocalAlloc LocalFree MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetFileSizeEx RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile

Name

.text

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

589KB

Virtual Size

589KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_7aeb3de217c419f931685b56d3f0829b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

mscoree

shell32

ole32

oleaut32

kernel32

generic