2026-08-20_e0b1ad60b5f911cbdeecb08f228d7832_cobalt-strike_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_e0b1ad60b5f911cbdeecb08f228d7832_cobalt-strike_glassworm_icedid_njrat
Size 3.5MB
Sample260820-fxq47seq41
SHA256 e3108eed8825fa4a25613c6893f312b2733ffddef747c37e95c0dc7ff79875a2
MD5 e0b1ad60b5f911cbdeecb08f228d7832
SHA1 4f9f1913836d14d020739022da508150c5a27345
SHA512 a6f6f20a4136cbcd07fc9f739b8b60ff3c8a9852e9c22c00421973f53f1f06c1377c54a8eb305ecd1caa4d4907114efe8b04555a834631d531175439fd0d8f00
SSDEEP 49152:39OxnXqm5zf4W66Ypm9Sv4BJsv6tWKFdu9C7PTvG7HqOqRsjfJXcRWYNoiBnnAJ8:sJoKJsv6tWKFdu9C7inHpEF
TLSH
T116067C86B6F61358D9B7C138C6A7616AEA317C46DF20A5CF125CB7191B336E05E3B308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-20_e0b1ad60b5f911cbdeecb08f228d7832_cobalt-strike_glassworm_icedid_njrat

File Explorer

2026-08-20_e0b1ad60b5f911cbdeecb08f228d7832_cobalt-strike_glassworm_icedid_njrat

.exe 3.5MB

2026-08-20_e0b1ad60b5f911cbdeecb08f228d7832_cobalt-strike_glassworm_icedid_njrat

IMPHASH acf48310fb5ddb24a760eb258f9c2fab
SHA256 e3108eed8825fa4a25613c6893f312b2733ffddef747c37e95c0dc7ff79875a2
MD5 e0b1ad60b5f911cbdeecb08f228d7832
SHA1 4f9f1913836d14d020739022da508150c5a27345
SHA512 a6f6f20a4136cbcd07fc9f739b8b60ff3c8a9852e9c22c00421973f53f1f06c1377c54a8eb305ecd1caa4d4907114efe8b04555a834631d531175439fd0d8f00
SSDEEP 49152:39OxnXqm5zf4W66Ypm9Sv4BJsv6tWKFdu9C7PTvG7HqOqRsjfJXcRWYNoiBnnAJ8:sJoKJsv6tWKFdu9C7inHpEF
TLSH
T116067C86B6F61358D9B7C138C6A7616AEA317C46DF20A5CF125CB7191B336E05E3B308
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6c:c5:f6:ef:28:13:0a:ba:6e:bd:ef:f4:85:05:f8:13:2f:4d:74:1f:65:1d:0d:2f:aa:f8:d6:e4:cb:72:91:ff

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 20, 2010

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:03:dc:f6:00:00:00:00:00:0c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2011

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:15:34:64:00:00:00:00:00:0c

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:02:dc:00:00:00:00:00:0b

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 15, 2005 - Mar 15, 2016

Minor OS version

Major OS version

Entry point

1511568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NO_BIND

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WideCharToMultiByte K32GetModuleInformation GetSystemPowerStatus lstrcatW lstrcmpiW GetModuleHandleW GetModuleFileNameW MapViewOfFile CreateFileMappingW VirtualProtect GetSystemDirectoryW GetSystemInfo GlobalMemoryStatusEx ExitProcess InitializeCriticalSectionEx DeviceIoControl HeapFree HeapAlloc GetLastError RaiseException DecodePointer GetDiskFreeSpaceExW CreateFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection LoadLibraryA GetProcAddress GetCurrentProcess Sleep WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP CloseHandle OutputDebugStringA GetCommandLineW GetCurrentProcessId LocalFree OutputDebugStringW TerminateProcess IsProcessorFeaturePresent GetConsoleWindow SetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter QueryPerformanceFrequency GetTickCount64 DuplicateHandle WaitForSingleObject WaitForMultipleObjects CreateThread GetCurrentThread GetCurrentThreadId SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageW GetSystemTime GetLocalTime ResetEvent GetFileAttributesExW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLogicalDrives GetLongPathNameW RemoveDirectoryW SetFileTime GetTempPathW GetVolumePathNamesForVolumeNameW SetErrorMode CopyFileW MoveFileW MoveFileExW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx FlushFileBuffers GetFileType ReadFile SetEndOfFile SetFilePointerEx WriteFile UnmapViewOfFile GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW GetUserDefaultLCID GetUserPreferredUILanguages MultiByteToWideChar FindFirstFileExW FindNextFileW UnregisterWaitEx RegisterWaitForSingleObject FreeLibrary GetModuleHandleExW LoadLibraryW GetTimeZoneInformation GetGeoInfoW GetUserGeoID GetExitCodeProcess OpenProcess ReleaseMutex CreateMutexW VirtualAlloc VirtualFree EncodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetCommandLineA ExitThread FreeLibraryAndExitThread GetConsoleMode ReadConsoleW GetConsoleCP SetFileAttributesW SetStdHandle GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapReAlloc SetEnvironmentVariableW InitializeCriticalSectionAndSpinCount LoadLibraryExW CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW GetFileSizeEx IsValidCodePage

user32

PeekMessageW PostMessageW DefWindowProcW DispatchMessageW CreateWindowExW TranslateMessage GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer GetWindowLongPtrW SetWindowLongPtrW CharNextExA UnregisterClassW DestroyWindow RegisterClassW EnumDisplayDevicesW

advapi32

RegQueryInfoKeyW GetSidSubAuthority RegQueryValueExW AccessCheck CopySid DuplicateToken GetLengthSid MapGenericMask LookupAccountSidW GetEffectiveRightsFromAclW GetNamedSecurityInfoW BuildTrusteeWithSidW SystemFunction036 RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegSetValueExW RegOpenKeyExW RegCloseKey GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenProcessToken GetSidSubAuthorityCount

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

NetShareEnum NetApiBufferFree

ws2_32

WSAAsyncSelect

winmm

timeKillEvent timeSetEvent

wevtapi

EvtRender EvtCreateRenderContext EvtNext EvtQuery EvtClose

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

shell32

CommandLineToArgvW

ole32

CoInitialize CoTaskMemFree CoCreateInstance CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_e0b1ad60b5f911cbdeecb08f228d7832_cobalt-strike_glassworm_icedid_njrat

PE Signature issue

kernel32

user32

advapi32

userenv

version

netapi32

ws2_32

winmm

wevtapi

d3d11

d3dcompiler_47

shell32

ole32

generic