General
- Target 2026-08-20_a502823e0fb552e83769937267ed034f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 7.8MB
- Sample260820-hm1a8st1cv
- SHA256 2db51ce9d2a5e42a1c4ee4ff0948ab63e05253a1c514e9a8da495aa5eca5a5f6
- MD5 a502823e0fb552e83769937267ed034f
- SHA1 5178fce664d952e9423f9b22472d341ed672f1bc
- SHA512 b43afbcdbe7129ed4096da4cf6f075c889f59d9853b58a563063eddf1cb943138503f0531c185531b75c00b79a4c141b8e31a57006a4cc81e106e72a923eb8b0
- SSDEEP 49152:kC0swYQhpObyFttSG/Fm8z0V2+GqmP3IbVzL/3eTsLxPm6knZl0gajg2aDDSeFOZ:/QRCU2LzLmTSHgMYO2iXremvU023W
- TLSH T171867C13F2A501E8D05ED9B4CF3A56329B357C4A4BB092EF269436E11A75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_a502823e0fb552e83769937267ed034f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_a502823e0fb552e83769937267ed034f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 7.8MB
- SHA256 2db51ce9d2a5e42a1c4ee4ff0948ab63e05253a1c514e9a8da495aa5eca5a5f6
- MD5 a502823e0fb552e83769937267ed034f
- SHA1 5178fce664d952e9423f9b22472d341ed672f1bc
- SHA512 b43afbcdbe7129ed4096da4cf6f075c889f59d9853b58a563063eddf1cb943138503f0531c185531b75c00b79a4c141b8e31a57006a4cc81e106e72a923eb8b0
- SSDEEP 49152:kC0swYQhpObyFttSG/Fm8z0V2+GqmP3IbVzL/3eTsLxPm6knZl0gajg2aDDSeFOZ:/QRCU2LzLmTSHgMYO2iXremvU023W
- TLSH T171867C13F2A501E8D05ED9B4CF3A56329B357C4A4BB092EF269436E11A75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1