General
- Target 2026-08-22_c6e918569b51011d27a578282631ec37_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- Sample260823-a1bwssgh76
- SHA256 eec48205cd5e11887f7516524bf3e977d47e34467da067e64f7f477b3df578ae
- MD5 c6e918569b51011d27a578282631ec37
- SHA1 93bf69c2ae1664e2478217e19684e09e69da2e49
- SHA512 83974a6fb2c76e9f93b3e4ecf4012269fd82cf3893897844eff39758b6416f2a268091db9d58e66175e19a9e75d71c4aaf233abf7c4d370ba25c22657340a2a8
- SSDEEP 98304:RSpbOrf4DgU6vBELOnTWPBx6wRcQKiKkKURgyLjR+gEiWyssUhV4GGMnI:oZOr1WoWnRSQRpEqsFhT
- TLSH T1E3A67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_c6e918569b51011d27a578282631ec37_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_c6e918569b51011d27a578282631ec37_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- SHA256 eec48205cd5e11887f7516524bf3e977d47e34467da067e64f7f477b3df578ae
- MD5 c6e918569b51011d27a578282631ec37
- SHA1 93bf69c2ae1664e2478217e19684e09e69da2e49
- SHA512 83974a6fb2c76e9f93b3e4ecf4012269fd82cf3893897844eff39758b6416f2a268091db9d58e66175e19a9e75d71c4aaf233abf7c4d370ba25c22657340a2a8
- SSDEEP 98304:RSpbOrf4DgU6vBELOnTWPBx6wRcQKiKkKURgyLjR+gEiWyssUhV4GGMnI:oZOr1WoWnRSQRpEqsFhT
- TLSH T1E3A67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1