General
- Target 2026-09-07_c2ec73f438f40a7e58f81372961effa8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- Sample260908-hcamtsstb1
- SHA256 6aa67596c9bbb36f36e0f0ed3921b0e1369af06e5a5ada7f88eb3f9461ef1108
- MD5 c2ec73f438f40a7e58f81372961effa8
- SHA1 613333e25170cb1987136ce0273d0c46761deabf
- SHA512 da4c45c5cd7944e6ac63e15c157c7174bf11cf58399dfc5da021255ac6470289a79b56d6cbb6bbb0411f646b925717256722424545980be97d03c3a4b55758a3
- SSDEEP 98304:OSpbOrf4DgU6vBELOnTWPBx6wRcQKiKkKURgyLjR+gEiWyssUhVWU023W:FZOr1WoWnRSQRpEqsFhAp4W
- TLSH T12BA67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_c2ec73f438f40a7e58f81372961effa8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-07_c2ec73f438f40a7e58f81372961effa8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 9.6MB
- SHA256 6aa67596c9bbb36f36e0f0ed3921b0e1369af06e5a5ada7f88eb3f9461ef1108
- MD5 c2ec73f438f40a7e58f81372961effa8
- SHA1 613333e25170cb1987136ce0273d0c46761deabf
- SHA512 da4c45c5cd7944e6ac63e15c157c7174bf11cf58399dfc5da021255ac6470289a79b56d6cbb6bbb0411f646b925717256722424545980be97d03c3a4b55758a3
- SSDEEP 98304:OSpbOrf4DgU6vBELOnTWPBx6wRcQKiKkKURgyLjR+gEiWyssUhVWU023W:FZOr1WoWnRSQRpEqsFhAp4W
- TLSH T12BA67C13F29501D9E16ED1788B6A5232AA72BC8A4B30B2DF3A4C76151F75FE05B3C724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1