2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc
Size 3.5MB
Sample260827-weshbaaf27
SHA256 9cd7da8e52cf80fdc19839e4dd095206d02f638ba1b635c39dd8771c289125f6
MD5 50d8b29663fbda9f0eb65569f4d597bc
SHA1 9207229c67973f21b2615e2b7e76821be5b7d1bb
SHA512 4be81e1f5f827e662a370c06d9d315006f34fdae396854814551e39e13b2728a841195faf9aa935a1cd7f45c9668da56ce4b242d53a4604315314cb0dab8ea19
SSDEEP 49152:6qabhjbsi69K3ZJF9bmUrqA7z866e+97kpZVNPWpPnrNLX3UEWx+8AIkWy69bk:0Gy97Y7kLPWXM8dc9b
TLSH
T15D06BF16A6E402ECE1F6D2B49D331403EAB37C4A4735A9EF0198555B0F27AE4CD7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc

File Explorer

2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc

.exe 3.5MB

2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc

IMPHASH 1d08f87441898db4673dcec8e4b1cf1d
SHA256 9cd7da8e52cf80fdc19839e4dd095206d02f638ba1b635c39dd8771c289125f6
MD5 50d8b29663fbda9f0eb65569f4d597bc
SHA1 9207229c67973f21b2615e2b7e76821be5b7d1bb
SHA512 4be81e1f5f827e662a370c06d9d315006f34fdae396854814551e39e13b2728a841195faf9aa935a1cd7f45c9668da56ce4b242d53a4604315314cb0dab8ea19
SSDEEP 49152:6qabhjbsi69K3ZJF9bmUrqA7z866e+97kpZVNPWpPnrNLX3UEWx+8AIkWy69bk:0Gy97Y7kLPWXM8dc9b
TLSH
T15D06BF16A6E402ECE1F6D2B49D331403EAB37C4A4735A9EF0198555B0F27AE4CD7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1420528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoInitializeEx CoUninitialize

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend

user32

AttachThreadInput BringWindowToTop ClientToScreen CloseDesktop CreateDesktopW EnumChildWindows EnumDesktopWindows EnumDesktopsW EnumWindows GetAncestor GetClassNameW GetClientRect GetCursorPos GetForegroundWindow GetGUIThreadInfo GetParent GetProcessWindowStation GetSystemMetrics GetThreadDesktop GetWindow GetWindowDC GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IsIconic IsWindow IsWindowEnabled IsWindowVisible MapVirtualKeyW OpenDesktopW PostMessageW PrintWindow ReleaseDC ScreenToClient SendInput SendMessageTimeoutW SetActiveWindow SetCursorPos SetFocus SetForegroundWindow SetThreadDesktop SetWindowPos ShowWindowAsync WindowFromPoint wsprintfA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

advapi32

AdjustTokenPrivileges ConvertSidToStringSidW CredDeleteW CredFree CredReadW CredWriteW GetTokenInformation IsValidSid LookupAccountSidW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

rpcrt4

NdrClientCall2 RpcBindingFree RpcBindingFromStringBindingW RpcBindingSetAuthInfoExW RpcEpResolveBinding RpcStringBindingComposeW RpcStringFreeW

crypt32

CryptStringToBinaryA

ws2_32

FreeAddrInfoW GetAddrInfoW InetNtopW InetPtonW WSACleanup WSAGetLastError WSAStartup bind closesocket connect getsockname htonl htons ntohl ntohs recv send setsockopt shutdown socket

iphlpapi

FreeMibTable GetIpForwardTable2 GetIpInterfaceEntry InitializeIpInterfaceEntry

rstrtmgr

RmEndSession RmRegisterResources RmShutdown RmStartSession

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

oleaut32

SysAllocStringLen SysFreeString SysStringLen

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusShutdown GdiplusStartup

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CopyFile2 CopyFileW CreateDirectoryW CreateFile2 CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceA FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetErrorMode GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetPrivateProfileIntW GetPrivateProfileSectionNamesW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetTickCount64 GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetEndOfFile SetErrorMode SetFileInformationByHandle SetFilePointer SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

417KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

329B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_50d8b29663fbda9f0eb65569f4d597bc_cobalt-strike_glassworm_icedid_njrat_ryuk_stealc

ole32

winhttp

user32

bcrypt

advapi32

rpcrt4

crypt32

ws2_32

iphlpapi

rstrtmgr

version

gdi32

oleaut32

gdiplus

kernel32

generic