2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom
Size 2.0MB
Sample260826-2bs8bsxdla
SHA256 085a66ff0f704d258eae3e4b3cf1ef2876038ab0fd9cb732ff606dc5518c88fa
MD5 6bc1189317ecd0861bfc2ebdfa8746ba
SHA1 d634a5f6f6cae3b092b7ab614e96cfd4a260080b
SHA512 bd4eb0d3f78f62826ed0603b44909d7625f29fbdccdbec2453fe7eca2b81aee5d6dec83f317f70cbed1c636535ce6173b46c6af2542342785d1f983f222d6ad7
SSDEEP 49152:jMPwCZ+PtIL0M4ZdsKJ7BTwUOXiaNyWSx36:Oa6KJ75wiaNyhxK
TLSH
T1F9A57D43E2A260EDC45BC2358B175222B671B8411734AEEB6258DB352F73FD05E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 2.0MB

2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH a5c33beae696529fbaf79dee4631de47
SHA256 085a66ff0f704d258eae3e4b3cf1ef2876038ab0fd9cb732ff606dc5518c88fa
MD5 6bc1189317ecd0861bfc2ebdfa8746ba
SHA1 d634a5f6f6cae3b092b7ab614e96cfd4a260080b
SHA512 bd4eb0d3f78f62826ed0603b44909d7625f29fbdccdbec2453fe7eca2b81aee5d6dec83f317f70cbed1c636535ce6173b46c6af2542342785d1f983f222d6ad7
SSDEEP 49152:jMPwCZ+PtIL0M4ZdsKJ7BTwUOXiaNyWSx36:Oa6KJ75wiaNyhxK
TLSH
T1F9A57D43E2A260EDC45BC2358B175222B671B8411734AEEB6258DB352F73FD05E3EB64
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptStringToBinaryA CryptUnprotectData

advapi32

AdjustTokenPrivileges DuplicateTokenEx GetTokenInformation GetUserNameA ImpersonateLoggedOnUser LookupPrivilegeValueA OpenProcessToken RegCloseKey RegDeleteValueA RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA RevertToSelf

ole32

CLSIDFromString CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysAllocStringByteLen SysFreeString SysStringByteLen VariantClear VariantInit

shell32

SHGetFolderPathA ShellExecuteA

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateFontIndirectA CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject SetBkMode SetStretchBltMode SetTextColor StretchBlt

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipLoadImageFromFile GdipSaveImageToFile GdiplusShutdown GdiplusStartup

avicap32

capCreateCaptureWindowA

user32

BeginPaint CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA DrawIconEx DrawTextA EnableWindow EndPaint ExitWindowsEx FillRect GetClientRect GetClipboardData GetDC GetDesktopWindow GetMessageA GetSysColorBrush GetSystemMetrics GetWindowRect GetWindowTextA IsClipboardFormatAvailable IsDialogMessageA KillTimer LoadCursorA LoadIconA LockWorkStation MessageBeep MessageBoxA MessageBoxW OpenClipboard PeekMessageA PostQuitMessage RegisterClassExA ReleaseDC SendMessageA SendMessageW SetCursor SetFocus SetForegroundWindow SetProcessDPIAware SetTimer SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TranslateMessage UpdateWindow

comctl32

InitCommonControlsEx

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler AllocConsole AreFileApisANSI CloseHandle CompareStringW CopyFileA CopyFileExA CreateDirectoryA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexW CreatePipe CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection ExitProcess ExitThread ExpandEnvironmentStringsA FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleA GetFullPathNameA GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemFirmwareTable GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetVolumePathNameA GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockFile LockFileEx MapViewOfFile Module32First Module32Next MoveFileExA MulDiv MultiByteToWideChar OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32First Process32FirstW Process32Next Process32NextW QueryDosDeviceA QueryFullProcessImageNameA QueryPerformanceCounter RaiseException ReadConsoleW ReadFile RemoveDirectoryA ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetFileAttributesA SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile lstrcmpA lstrcmpiA lstrcpynA

Name

.c5449F

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.r5449F

Size

553KB

Virtual Size

552KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.d1B7F1

Size

18KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.j5C52E

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kDAB4A

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

llvmmsvc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_6bc1189317ecd0861bfc2ebdfa8746ba_cobalt-strike_glassworm_icedid_njrat_satacom

bcrypt

crypt32

advapi32

ole32

oleaut32

shell32

gdi32

gdiplus

avicap32

user32

comctl32

iphlpapi

kernel32

generic