2026-09-16_24ecac9707477cc4e0190053da480611_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_24ecac9707477cc4e0190053da480611_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 1.5MB
Sample260916-27ed2sfd64
SHA256 f79fc9a5d35da61d47ef33babf11d25a0367181ecbc384ace762ea66b9a559b7
MD5 24ecac9707477cc4e0190053da480611
SHA1 267d93b8b1dca4b40939fb7473a70cfc9bc27443
SHA512 ccd35acbc57a1fb8d197bce9af70a6af1aae2f51f71c5965f61c997ba598df57a5d4807a718e5e978ccf5b8ab1223768dfac33ba0410a8259bd0a5395599da03
SSDEEP 12288:KbTdnwq148FcfpDyv4Lk3o5m+/D4Ep5pNt03L9F1YiY0ctqxz/yasN9tC/XEK:e141hGvKyEp5pNSLxcoxz/y/N9w/X/
TLSH
T1557538292E641DCCD466843ECB83869FE2B1BC1A1F714BD717A17BA76E320D01A7B351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-16_24ecac9707477cc4e0190053da480611_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 1.5MB

2026-09-16_24ecac9707477cc4e0190053da480611_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 94ef711801b576f2c67104475314fa6c
SHA256 f79fc9a5d35da61d47ef33babf11d25a0367181ecbc384ace762ea66b9a559b7
MD5 24ecac9707477cc4e0190053da480611
SHA1 267d93b8b1dca4b40939fb7473a70cfc9bc27443
SHA512 ccd35acbc57a1fb8d197bce9af70a6af1aae2f51f71c5965f61c997ba598df57a5d4807a718e5e978ccf5b8ab1223768dfac33ba0410a8259bd0a5395599da03
SSDEEP 12288:KbTdnwq148FcfpDyv4Lk3o5m+/D4Ep5pNt03L9F1YiY0ctqxz/yasN9tC/XEK:e141hGvKyEp5pNSLxcoxz/y/N9w/X/
TLSH
T1557538292E641DCCD466843ECB83869FE2B1BC1A1F714BD717A17BA76E320D01A7B351
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

67:08:7b:36:e7:09:7a:41:94:07:f6:c5:21:15:25:0a:49:a5:24:01:a8:c5:d9:9e:cf:78:85:fb:ec:15:c8:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 4, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:12:24:60:a1:f7:9e:85:5e:1d:a9:a8:af:ca:9e:b2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 15, 2026 - Jul 17, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

372288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\output\unity\unity\artifacts\UnityCrashHandler\Win_x64_VS2022_VB_MT_nondev_m_m\UnityCrashHandler64.pdb

user32

LookupIconIdFromDirectoryEx GetDlgItem SendDlgItemMessageA AdjustWindowRect GetWindowLongA OffsetRect DialogBoxParamA SetWindowTextW EndDialog SendMessageW UnionRect GetIconInfo SetWindowPos InflateRect CreateIconFromResourceEx LoadImageA SetForegroundWindow

kernel32

HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetModuleHandleExW MultiByteToWideChar GetLastError QueryPerformanceFrequency QueryPerformanceCounter ReadFile SizeofResource FindFirstFileW EnterCriticalSection GetCommandLineW FindNextFileW GetCurrentProcess WriteFile TerminateProcess EnumResourceNamesA LeaveCriticalSection InitializeCriticalSection SetErrorMode SetFilePointer SetEndOfFile FindResourceA FindClose WaitForSingleObject CreateFileW UnmapViewOfFile GetModuleHandleA GetExitCodeThread SetEvent TerminateThread LoadLibraryA LockResource DeleteFileW CloseHandle LoadLibraryW CreateThread LoadResource GetProcAddress CreateFileMappingA GetFileSize DeleteCriticalSection ReadProcessMemory GetCurrentProcessId CreateProcessW FreeLibrary CopyFileW WideCharToMultiByte CreateEventA MapViewOfFile LoadLibraryExW FlushFileBuffers GetStdHandle GetProcessId GetTempPathW WaitForMultipleObjectsEx GetFileAttributesW OpenProcess Sleep GetThreadId GetSystemTimeAsFileTime GetSystemTime CopyFileExW AllocConsole GetExitCodeProcess CreateDirectoryW GetFileSizeEx FindFirstFileExW TlsSetValue GetFullPathNameW RemoveDirectoryW SetFileTime GetModuleFileNameW HeapSize IsValidCodePage GetDiskFreeSpaceExW SetFilePointerEx MoveFileExW ReplaceFileW SystemTimeToFileTime GetModuleHandleW TlsGetValue GetTempFileNameW CreateEventW FormatMessageW LocalFree SetWaitableTimer GetCurrentThreadId ResumeThread GetCurrentThread WaitForSingleObjectEx SleepEx CreateWaitableTimerExW OpenThread GetModuleFileNameA HeapFree SetLastError RtlCaptureContext OutputDebugStringA RtlVirtualUnwind Thread32Next RtlLookupFunctionEntry Thread32First GetEnvironmentVariableA SuspendThread GetCurrentDirectoryA CreateToolhelp32Snapshot GetFileAttributesA HeapAlloc GetThreadContext VerSetConditionMask GetProcessHeap VerifyVersionInfoW TlsAlloc TlsFree IsDebuggerPresent AcquireSRWLockExclusive ExitProcess WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetConsoleMode GetConsoleOutputCP GetFileType SetStdHandle SetConsoleCtrlHandler GetStartupInfoW IsProcessorFeaturePresent GetACP GetOEMCP InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo CompareStringEx SetFileAttributesW HeapQueryInformation GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetFileAttributesExW RtlUnwind LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW TryAcquireSRWLockExclusive InitializeSListHead ReleaseSRWLockExclusive

dbghelp

SymLoadModuleEx SymRegisterFunctionEntryCallback64 MiniDumpWriteDump ImageDirectoryEntryToDataEx

shell32

SHCreateDirectoryExW CommandLineToArgvW SHFileOperationW SHGetKnownFolderPath

ole32

CoTaskMemFree CoCreateGuid CoInitializeEx

shlwapi

PathCanonicalizeW

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

HttpQueryInfoA HttpOpenRequestA InternetCrackUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA

gdi32

GetObjectA

bcrypt

BCryptDeriveKeyPBKDF2 BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_24ecac9707477cc4e0190053da480611_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

user32

kernel32

dbghelp

shell32

ole32

shlwapi

psapi

advapi32

wininet

gdi32

bcrypt

api-ms-win-core-synch-l1-2-0

version

generic