2026-08-20_e99a01b988ee3a0ae08430cc89683160_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_e99a01b988ee3a0ae08430cc89683160_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 13.3MB
Sample260820-lerwnstdkg
SHA256 5cec617283a92d1a285779389aa6725c8cb84ec0a6a28ffe73e8e95cfc66bdc4
MD5 e99a01b988ee3a0ae08430cc89683160
SHA1 41b420f3b87f1001307aabd2319184bb6db96c6e
SHA512 a10f8da2b874fa05fb28e64574e537bf63237a39f028f7a676a67a2a0bd68930a5c849791b770ffdfcc7c000454b8f086b051fdba4c68e6dacf766b38f29f315
SSDEEP 393216:dwygclwdWEiugmyBNWNnnZvc2BEjItel/RZ:dHZlFay+kee
TLSH
T12EE6BD13788A0E28CC695139567B9F9AA4F388CD0BE495BB43743CFB2EB3350459B275
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_e99a01b988ee3a0ae08430cc89683160_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-08-20_e99a01b988ee3a0ae08430cc89683160_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 13.3MB

2026-08-20_e99a01b988ee3a0ae08430cc89683160_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 641f6477a040381872fffc9d193342ac
SHA256 5cec617283a92d1a285779389aa6725c8cb84ec0a6a28ffe73e8e95cfc66bdc4
MD5 e99a01b988ee3a0ae08430cc89683160
SHA1 41b420f3b87f1001307aabd2319184bb6db96c6e
SHA512 a10f8da2b874fa05fb28e64574e537bf63237a39f028f7a676a67a2a0bd68930a5c849791b770ffdfcc7c000454b8f086b051fdba4c68e6dacf766b38f29f315
SSDEEP 393216:dwygclwdWEiugmyBNWNnnZvc2BEjItel/RZ:dHZlFay+kee
TLSH
T12EE6BD13788A0E28CC695139567B9F9AA4F388CD0BE495BB43743CFB2EB3350459B275
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileAttributesExW GlobalSize SetEvent FileTimeToSystemTime DeleteFileW CloseHandle GetProcAddress GlobalLock LocalFree GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte GetTempFileNameW GetSystemTime GlobalUnlock GetExitCodeProcess SizeofResource LockResource LoadResource FindResourceW GetLastError IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ProcessIdToSessionId GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTickCount64 IsDebuggerPresent Sleep MultiByteToWideChar CreateEventW GetLogicalDriveStringsW GetComputerNameExW GetSystemDirectoryW GetFileAttributesW CreateFileW WaitForSingleObject FindClose CreateMutexW SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileType HeapFree HeapAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetTempPathW GetModuleFileNameW GetCurrentProcess FindNextFileW GetCommandLineW SetLastError FindFirstFileExW GetFileSizeEx ExitThread CreateThread RtlUnwind LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException GetCPInfo RtlPcToFileHeader RtlUnwindEx InitializeSListHead ReadConsoleW ReadFile GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer QueryPerformanceCounter LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetStartupInfoW

user32

ReleaseCapture ShowWindow PeekMessageW SetCapture GetMessageW GetClientRect LoadCursorW LoadIconW TranslateMessage GetSysColor DestroyIcon DispatchMessageW RegisterClassExW GetSystemMetrics PostQuitMessage DefWindowProcW DestroyWindow MessageBoxW SystemParametersInfoW SetProcessDPIAware UpdateWindow CreateWindowExW

gdi32

DeleteObject GetStockObject

advapi32

GetTokenInformation RegDeleteValueW ConvertSidToStringSidW RegGetValueW RegOpenKeyExW OpenProcessToken RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

CommandLineToArgvW SHGetFileInfoW SHCreateDirectoryExW SHCreateItemWithParent ord25 SHGetKnownFolderPath SHGetIDListFromObject SHCreateItemFromParsingName

ole32

CoCreateInstance StringFromGUID2 CreateStreamOnHGlobal CoInitializeEx CoCreateGuid CoTaskMemFree CoUninitialize GetHGlobalFromStream

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

crypt32

CryptBinaryToStringA CryptStringToBinaryA

cabinet

ord34 ord30 ord33 ord35

shlwapi

StrRetToBufW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpWriteData WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

Name

.text

Size

350KB

Virtual Size

349KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12.9MB

Virtual Size

12.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_e99a01b988ee3a0ae08430cc89683160_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

crypt32

cabinet

shlwapi

winhttp

d3d11

d3dcompiler_47

generic