2026-08-31_153dd3ff6008e19326ffbdf74d955a27_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_153dd3ff6008e19326ffbdf74d955a27_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260831-2tzstszepd
SHA256 f5e099666478ebcf1b437783b59366cb1ec30527595cee88d4073d3015aad9c4
MD5 153dd3ff6008e19326ffbdf74d955a27
SHA1 0801f28835dc37aa282635c77216a4fb160f022f
SHA512 761f333811f1534fc5cb2f1496c5714f631cab75b240afe84b08c3a37c15be6750dd15f24da6fda5aa390fcb84d8da996c083fc4be8624e0b32acce3c46c3fd6
SSDEEP 49152:1PRI1+fu7NTbTHbujm9oheqgINUeSeURD:Yiy9GiINUeSeC
TLSH
T10495F122E6A401FDD177D179CA165912F7B3785B0331ABDB03D0895A2F2B6D88E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_153dd3ff6008e19326ffbdf74d955a27_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-31_153dd3ff6008e19326ffbdf74d955a27_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-08-31_153dd3ff6008e19326ffbdf74d955a27_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 1cfe8626931b9f8e092422c23ba2cb5d
SHA256 f5e099666478ebcf1b437783b59366cb1ec30527595cee88d4073d3015aad9c4
MD5 153dd3ff6008e19326ffbdf74d955a27
SHA1 0801f28835dc37aa282635c77216a4fb160f022f
SHA512 761f333811f1534fc5cb2f1496c5714f631cab75b240afe84b08c3a37c15be6750dd15f24da6fda5aa390fcb84d8da996c083fc4be8624e0b32acce3c46c3fd6
SSDEEP 49152:1PRI1+fu7NTbTHbujm9oheqgINUeSeURD:Yiy9GiINUeSeC
TLSH
T10495F122E6A401FDD177D179CA165912F7B3785B0331ABDB03D0895A2F2B6D88E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData

crypt32

CryptBinaryToStringW

ole32

CoUninitialize CoCreateInstance CLSIDFromString StringFromGUID2 CoCreateGuid PropVariantClear CoTaskMemFree CoInitializeEx

d2d1

ord1

dwmapi

DwmSetWindowAttribute

dwrite

DWriteCreateFactory

gdi32

SelectObject RoundRect LineTo GetStockObject Ellipse SetBkMode SetTextColor DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt SetBkColor MoveToEx

mfplat

MFCreateAttributes MFCreateMediaType MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromURL

shell32

CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath

user32

TrackMouseEvent GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW SetProcessDpiAwarenessContext GetScrollInfo LoadIconW LoadCursorW SetWindowLongPtrW GetWindowLongPtrW PtInRect FillRect ScreenToClient GetCursorPos SetCursor MessageBoxW GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint SetForegroundWindow UpdateWindow DrawTextW GetSystemMetrics KillTimer SetTimer ShowWindow DefWindowProcW IsWindow CreateWindowExW RegisterClassExW PostQuitMessage DestroyWindow

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

kernel32

GetConsoleOutputCP EnumSystemLocalesW GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetConsoleMode SizeofResource GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW GetFileInformationByHandleEx CopyFile2 GetProcAddress AreFileApisANSI CreateFile2 SetFileInformationByHandle GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW FlushFileBuffers ReadFile WriteFile CloseHandle DuplicateHandle GetLastError ConnectNamedPipe CreateNamedPipeW GetOverlappedResult CancelIoEx ResetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess ResumeThread CreateProcessW OpenProcess GetSystemTime GetLocalTime GetTickCount64 GetModuleFileNameW GetModuleHandleW LoadResource LockResource RtlUnwind FindResourceW LocalFree FormatMessageW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileW ReleaseMutex CreateMutexW GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW RtlPcToFileHeader RaiseException QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

Name

.text

Size

485KB

Virtual Size

485KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_153dd3ff6008e19326ffbdf74d955a27_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

bcrypt

crypt32

ole32

d2d1

dwmapi

dwrite

gdi32

mfplat

mfreadwrite

shell32

user32

winhttp

kernel32

api-ms-win-core-synch-l1-2-0

generic