General
- Target 2026-09-06_b9dcb8e411a95eceb0a6335db9f6f247_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.1MB
- Sample260906-x17pssch46
- SHA256 1ae0aef957b55a5a96e6dda2c79b04df1a263960c3f36bc864dc3fe0bc940140
- MD5 b9dcb8e411a95eceb0a6335db9f6f247
- SHA1 755ff641e073ed958bb0df5492682e0c61d9deb5
- SHA512 a6e32a4a6304ff70755b3a2912ae21f339626915a73a02582bbd3941b7afac6250e6e4f4310d2a3a930cd7f3f0df3e31482d03bb56e6102137b2e7295aa94bb3
- SSDEEP 98304:tnEtIvPeUUu3RHDYIv6LOKWFqnVD527BWG:tM4qu3RH15KWKVVQBWG
- TLSH T164868D13F2A501E8D05ED974CF3A56329B317C4A8BB0A2EF169436E11A75ED47B3CB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_b9dcb8e411a95eceb0a6335db9f6f247_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-06_b9dcb8e411a95eceb0a6335db9f6f247_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.1MB
- SHA256 1ae0aef957b55a5a96e6dda2c79b04df1a263960c3f36bc864dc3fe0bc940140
- MD5 b9dcb8e411a95eceb0a6335db9f6f247
- SHA1 755ff641e073ed958bb0df5492682e0c61d9deb5
- SHA512 a6e32a4a6304ff70755b3a2912ae21f339626915a73a02582bbd3941b7afac6250e6e4f4310d2a3a930cd7f3f0df3e31482d03bb56e6102137b2e7295aa94bb3
- SSDEEP 98304:tnEtIvPeUUu3RHDYIv6LOKWFqnVD527BWG:tM4qu3RH15KWKVVQBWG
- TLSH T164868D13F2A501E8D05ED974CF3A56329B317C4A8BB0A2EF169436E11A75ED47B3CB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1