2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 4.2MB
Sample260909-e7ctws1yfv
SHA256 83ebf5fe0bc4aba9b1a25e5a5b156de7f24e9f7fa4da2bd0811950d734fdf210
MD5 2e2e9e77d492306071d422dd63ed8bbb
SHA1 2da04fc5d78783f182195d2e056045856e5567de
SHA512 67b664d4519e99017442ba1770c91bc2342893f0405286eca1d3b9bc38430f2ce9294748444cf979246f519aa6d53c79507b6b443efa7409427d9dbdbc6d76b6
SSDEEP 49152:afLTXBV2MRT5OR20Oq5X08MRT5OR20Oq5X0t+LA5Z/h92e9G6svtc55:crJRT5OR2Fq5X8RT5OR2Fq5Xk2eQP1I
TLSH
T19116F252EAD0905CC673C2744D277501D72AB5FB27F4A6CB76DE802D6F62A808E37B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 4.2MB

2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 98250fc0cd014c25c9ce3316e1c51f5b
SHA256 83ebf5fe0bc4aba9b1a25e5a5b156de7f24e9f7fa4da2bd0811950d734fdf210
MD5 2e2e9e77d492306071d422dd63ed8bbb
SHA1 2da04fc5d78783f182195d2e056045856e5567de
SHA512 67b664d4519e99017442ba1770c91bc2342893f0405286eca1d3b9bc38430f2ce9294748444cf979246f519aa6d53c79507b6b443efa7409427d9dbdbc6d76b6
SSDEEP 49152:afLTXBV2MRT5OR20Oq5X08MRT5OR20Oq5X0t+LA5Z/h92e9G6svtc55:crJRT5OR2Fq5X8RT5OR2Fq5Xk2eQP1I
TLSH
T19116F252EAD0905CC673C2744D277501D72AB5FB27F4A6CB76DE802D6F62A808E37B24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4398080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dnsapi

DnsQuery_W DnsFree

advapi32

EventSetInformation EventUnregister EventWriteTransfer OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueA RegCloseKey RegOpenKeyExW RegQueryValueExW EventRegister RegGetValueW

user32

IsWindowVisible LoadIconW LoadCursorA EnumWindows FindWindowW ScreenToClient MessageBoxW GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA PostMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow GetClientRect SetWindowPos SetFocus keybd_event ReleaseCapture SetTimer KillTimer GetSystemMetrics UpdateWindow SetForegroundWindow BeginPaint EndPaint InvalidateRect GetWindowTextW

shell32

ShellExecuteExW SHEmptyRecycleBinW ShellExecuteW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoUninitialize

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

dwmapi

DwmSetWindowAttribute

urlmon

URLDownloadToFileW

gdiplus

GdipDeletePath GdipAlloc GdipSetStringFormatAlign GdipDeleteStringFormat GdipFree GdiplusStartup GdipCreatePath GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipAddPathEllipseI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateLineBrush GdipCreatePen1 GdipDeletePen GdipSetPenStartCap GdipSetPenEndCap GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipDrawLine GdipDrawRectangleI GdipDrawEllipseI GdipFillRectangleI GdipFillEllipseI GdipDrawImageRectI GdipSetClipPath GdipResetClip GdipCreateFontFamilyFromName GdiplusShutdown

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpQueryHeaders WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

kernel32

GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetCommandLineW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetFileType FreeLibraryAndExitThread ExitThread CreateThread IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetConsoleOutputCP RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx FormatMessageA LocalFree GetSystemTimePreciseAsFileTime LoadLibraryExW OutputDebugStringA Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetProcessMemoryInfo K32EmptyWorkingSet K32GetModuleFileNameExW GetStdHandle GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileSize ReadFile WriteFile GetTempPathW IsDebuggerPresent DebugBreak OutputDebugStringW CheckRemoteDebuggerPresent CloseHandle SetHandleInformation GetLastError SetLastError CreatePipe QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateMutexW OpenSemaphoreW CreateMutexExW CreateSemaphoreExW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess GetExitCodeProcess GetCurrentThread GetCurrentThreadId CreateProcessW GetThreadContext OpenProcess GetSystemTimes GlobalMemoryStatusEx GetTickCount GetTickCount64 GetSystemDirectoryW GetWindowsDirectoryW GetSystemWindowsDirectoryW ReadProcessMemory FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GlobalFree FormatMessageW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow RtlUnwind

Name

.text

Size

434KB

Virtual Size

434KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_2e2e9e77d492306071d422dd63ed8bbb_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

dnsapi

advapi32

user32

shell32

ole32

gdi32

dwmapi

urlmon

gdiplus

winhttp

kernel32

generic