2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 24.0MB
Sample260819-e37hpsdn3s
SHA256 ac6db08f5192be4b3eacf46cfc1ec26eeb1c087ae23c589f9849d21a5f8baf7d
MD5 c1bf74f8969e73383bd4dfc7c3a6596e
SHA1 4d9c7a433efde4dc2b4395e61d00d96ddf4c2d4e
SHA512 8843b77d0dce2bb00f40fd906c3c2363566bfc33db52d46097b6c78f68734b877f30575ae457dae1bb98b31ff1a0837f54562607067bef5c40f1c41cf49bc01b
SSDEEP 393216:8Vn7fwRX6DGwqtwNFv8h10S/o5X8+EUgfb2Gl5s8OvLG1wk3qOcYPfYYis4nWVEE:8lwRX6DGwqtICpo5sZzDpjsrG1w+gYPP
TLSH
T116473305DFAB45E6D1BF947C98825613D7A538490360EACF2B5489EB4F36BE40B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 24.0MB

2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH a56ac4795e17db1bebd7bedd9bcd450c
SHA256 ac6db08f5192be4b3eacf46cfc1ec26eeb1c087ae23c589f9849d21a5f8baf7d
MD5 c1bf74f8969e73383bd4dfc7c3a6596e
SHA1 4d9c7a433efde4dc2b4395e61d00d96ddf4c2d4e
SHA512 8843b77d0dce2bb00f40fd906c3c2363566bfc33db52d46097b6c78f68734b877f30575ae457dae1bb98b31ff1a0837f54562607067bef5c40f1c41cf49bc01b
SSDEEP 393216:8Vn7fwRX6DGwqtwNFv8h10S/o5X8+EUgfb2Gl5s8OvLG1wk3qOcYPfYYis4nWVEE:8lwRX6DGwqtICpo5sZzDpjsrG1w+gYPP
TLSH
T116473305DFAB45E6D1BF947C98825613D7A538490360EACF2B5489EB4F36BE40B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25014272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetMessageW TranslateMessage DispatchMessageW PostMessageW GetAsyncKeyState GetCursorPos ScreenToClient SetWindowLongPtrW FindWindowW SetWindowsHookExW CallNextHookEx

crypt32

CertFreeCertificateContext CertCloseStore CertFindCertificateInStore CryptStringToBinaryA CertAddCertificateContextToStore CertOpenStore CertCreateCertificateContext

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

bcrypt

BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

kernel32

IsValidLocale GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx LCMapStringW CompareStringW UnhandledExceptionFilter IsDebuggerPresent GetCommandLineW GetCommandLineA WriteFile SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap AddVectoredExceptionHandler Sleep GetModuleFileNameW SetConsoleCtrlHandler SetConsoleOutputCP GetStdHandle GetEnvironmentVariableW GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleW GetLastError GetModuleHandleW SetFilePointerEx LockResource SizeofResource FindResourceW DeleteFileW SetFileAttributesW GetTempPathW CloseHandle GetCurrentProcessId MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess QueryFullProcessImageNameW GetCurrentProcess GetCurrentThreadId OpenThread SuspendThread ResumeThread GetProcessMitigationPolicy SetProcessMitigationPolicy GetProcAddress LoadLibraryExW K32GetModuleInformation Thread32First Thread32Next GetTempFileNameW WaitForSingleObject VirtualProtect GetProcessId GetModuleHandleA VirtualProtectEx WriteProcessMemory CreateThread HeapCreate HeapAlloc HeapReAlloc HeapFree GetThreadContext SetThreadContext FlushInstructionCache GetSystemInfo VirtualAlloc VirtualFree VirtualQuery RaiseException LoadResource ReadConsoleW IsProcessorFeaturePresent GetModuleHandleExW FreeLibrary ExitProcess FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead

iphlpapi

GetExtendedTcpTable

ws2_32

closesocket connect ioctlsocket htonl htons ntohs select socket WSAStartup WSAGetLastError

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind RtlUnwind RtlPcToFileHeader

Name

.text

Size

291KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22.9MB

Virtual Size

22.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcdf17

Size

628KB

Virtual Size

820KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

user32

crypt32

winhttp

bcrypt

kernel32

iphlpapi

ws2_32

ntdll

generic