General
- Target 2026-08-28_c42947bbc063488edd1f58aa2a613bf6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 4.2MB
- Sample260828-k2zpcswapf
- SHA256 5f813711a3cba4077a0e3673c0af567861d3c59f14eaed74a09c1e482f21dc52
- MD5 c42947bbc063488edd1f58aa2a613bf6
- SHA1 b8715bd569780f9a16655ba9e3a235d19699507a
- SHA512 7aa13babeed29d2f8937f1458d899a5fc5f1b07c426fa623a9e9cbb253038b2c370eb390dbc01bdbf2fb130db88815366aff9f2bd6690abdbbcc508365b204e2
- SSDEEP 49152:3ftTX6V2MRT5OR20Oq5X08MRT5OR20Oq5X0t+LA5Z/h92e9G6svtc55:lgJRT5OR2Fq5X8RT5OR2Fq5Xk2eQP1I
- TLSH T1B216F252EAD0905CC673C2744D277501E72AB5FB27F4A6CB76DE402D6F62A808E37B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-28_c42947bbc063488edd1f58aa2a613bf6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_c42947bbc063488edd1f58aa2a613bf6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-28_c42947bbc063488edd1f58aa2a613bf6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 4.2MB
- SHA256 5f813711a3cba4077a0e3673c0af567861d3c59f14eaed74a09c1e482f21dc52
- MD5 c42947bbc063488edd1f58aa2a613bf6
- SHA1 b8715bd569780f9a16655ba9e3a235d19699507a
- SHA512 7aa13babeed29d2f8937f1458d899a5fc5f1b07c426fa623a9e9cbb253038b2c370eb390dbc01bdbf2fb130db88815366aff9f2bd6690abdbbcc508365b204e2
- SSDEEP 49152:3ftTX6V2MRT5OR20Oq5X08MRT5OR20Oq5X0t+LA5Z/h92e9G6svtc55:lgJRT5OR2Fq5X8RT5OR2Fq5Xk2eQP1I
- TLSH T1B216F252EAD0905CC673C2744D277501E72AB5FB27F4A6CB76DE402D6F62A808E37B24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks whether UAC is enabled
-
Suspicious use of NtSetInformationThreadHideFromDebugger