General
- Target 2026-09-06_4cd659f909cfd084389df9b6802e63ab_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
- Size 562KB
- Sample260907-ebfkxayake
- SHA256 bcabd46d14145db236e88d48ff621760d12682c16c0b019250a63079bf50bd00
- MD5 4cd659f909cfd084389df9b6802e63ab
- SHA1 1b1b9aea8ea951ca04c2fccedae06d826f693d0a
- SHA512 5df385d9b1be02b887985e891d0534e7c8549e20c9722ddeae5b8f2df7d78cb373d3e1430a5f81db5509b750930d9691dd8a8dd6e3b6c1286efd7098bc69386e
- SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msuvkejBHNp0fc7:6yvglrBAfc7
- TLSH T18DC43806B7480FB8D56F8174C9924596DB377C4A4F21ABDF07946E2A3E326E08E39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-06_4cd659f909cfd084389df9b6802e63ab_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_4cd659f909cfd084389df9b6802e63ab_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-06_4cd659f909cfd084389df9b6802e63ab_cobalt-strike_glassworm_hijackloader_icedid_ryuk_satacom_stealc_vidar_xworm
- Size 562KB
- SHA256 bcabd46d14145db236e88d48ff621760d12682c16c0b019250a63079bf50bd00
- MD5 4cd659f909cfd084389df9b6802e63ab
- SHA1 1b1b9aea8ea951ca04c2fccedae06d826f693d0a
- SHA512 5df385d9b1be02b887985e891d0534e7c8549e20c9722ddeae5b8f2df7d78cb373d3e1430a5f81db5509b750930d9691dd8a8dd6e3b6c1286efd7098bc69386e
- SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msuvkejBHNp0fc7:6yvglrBAfc7
- TLSH T18DC43806B7480FB8D56F8174C9924596DB377C4A4F21ABDF07946E2A3E326E08E39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Executes dropped EXE
-
Modifies system executable filetype association