2026-09-16_d2cddb8f619988d39977ef74af285cf5_cobalt-strike_glassworm_hijackloader_icedid

General

Target
2026-09-16_d2cddb8f619988d39977ef74af285cf5_cobalt-strike_glassworm_hijackloader_icedid
Size 7.7MB
Sample260916-t88ehsdm7z
SHA256 0fb3d7e5648cacc513d21994642c3f601026bae2d8705eaf079d324b1caf1c36
MD5 d2cddb8f619988d39977ef74af285cf5
SHA1 de1862207b953d772ea366e578d94a32b1d616e1
SHA512 97718dfb3e91810c42c675a3cb032ce0f7cd9c5a95bc9638ab92a2cb20212145cb38b128a4fbe7c3fcbabe358dfc3245b9204cffb7ccf2e372d214f21fa91cce
SSDEEP 98304:If8GYfW1BHj8SExf+1CnXTxQ9LDj6eblG+L9nDHPdQodN2701Tu:If8/+XAScf+8nXdQvPtL97dPdNY01Tu
TLSH
T1B586F17BA3E845ECE3778539A5660E6248307C0D5B31D5BF5249076C1DB2B298EBC33A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_d2cddb8f619988d39977ef74af285cf5_cobalt-strike_glassworm_hijackloader_icedid

File Explorer

2026-09-16_d2cddb8f619988d39977ef74af285cf5_cobalt-strike_glassworm_hijackloader_icedid

.exe 7.7MB

2026-09-16_d2cddb8f619988d39977ef74af285cf5_cobalt-strike_glassworm_hijackloader_icedid

IMPHASH 8a190ab3a482abc538a41c0827de2d39
SHA256 0fb3d7e5648cacc513d21994642c3f601026bae2d8705eaf079d324b1caf1c36
MD5 d2cddb8f619988d39977ef74af285cf5
SHA1 de1862207b953d772ea366e578d94a32b1d616e1
SHA512 97718dfb3e91810c42c675a3cb032ce0f7cd9c5a95bc9638ab92a2cb20212145cb38b128a4fbe7c3fcbabe358dfc3245b9204cffb7ccf2e372d214f21fa91cce
SSDEEP 98304:If8GYfW1BHj8SExf+1CnXTxQ9LDj6eblG+L9nDHPdQodN2701Tu:If8/+XAScf+8nXdQvPtL97dPdNY01Tu
TLSH
T1B586F17BA3E845ECE3778539A5660E6248307C0D5B31D5BF5249076C1DB2B298EBC33A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

22544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle ContinueDebugEvent CreateEventW CreateFileMappingW CreateFileW DeleteCriticalSection DeleteProcThreadAttributeList DeviceIoControl EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UpdateProcThreadAttribute WaitForDebugEvent WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile lstrcatW lstrcmpiW lstrcpyW

ddraw

DirectDrawCreate

d3d11

D3D11CreateDevice

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_d2cddb8f619988d39977ef74af285cf5_cobalt-strike_glassworm_hijackloader_icedid

kernel32

ddraw

d3d11

generic