General
- Target 2026-09-11_3adb45728563089dcb288fa8d330fdf2_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.2MB
- Sample260912-ndkr3svfma
- SHA256 fa9518d2ce4e915e0711df626d8c88a6a5fe0d07a103733a7dd0d2659807f9a0
- MD5 3adb45728563089dcb288fa8d330fdf2
- SHA1 a8a359abf75913fd8d6a860ee1d8efe7e7ead2ef
- SHA512 368ff77c6ceb0d21bc5e4b313f24244d7a388a40d1280aae70916e8f16db0b14eeb482ba8d9827af9d1f3f55310c0291f79612b993b96b208756fca38b86f8a0
- SSDEEP 98304:12hdrR6ylhBXvAWlcOOz0PHDW5/asxblmyLMDCAgD527BWG:8a4f/uOOz0PHDW5/a25LergVQBWG
- TLSH T170868D13F3A501E8D05ED5B4CF3A56329A357C4A4BB0A2EF269436E11A75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-11_3adb45728563089dcb288fa8d330fdf2_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-11_3adb45728563089dcb288fa8d330fdf2_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.2MB
- SHA256 fa9518d2ce4e915e0711df626d8c88a6a5fe0d07a103733a7dd0d2659807f9a0
- MD5 3adb45728563089dcb288fa8d330fdf2
- SHA1 a8a359abf75913fd8d6a860ee1d8efe7e7ead2ef
- SHA512 368ff77c6ceb0d21bc5e4b313f24244d7a388a40d1280aae70916e8f16db0b14eeb482ba8d9827af9d1f3f55310c0291f79612b993b96b208756fca38b86f8a0
- SSDEEP 98304:12hdrR6ylhBXvAWlcOOz0PHDW5/asxblmyLMDCAgD527BWG:8a4f/uOOz0PHDW5/a25LergVQBWG
- TLSH T170868D13F3A501E8D05ED5B4CF3A56329A357C4A4BB0A2EF269436E11A75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1