2026-09-20_da765e57d67e2ad5f68d81a779d01f20_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-20_da765e57d67e2ad5f68d81a779d01f20_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 1.9MB
Sample260920-vyhlsazdqa
SHA256 f640525d917bc7acea9db71a5e1a9a471821d073349eb8bfa6e1a78365259d79
MD5 da765e57d67e2ad5f68d81a779d01f20
SHA1 ede8e281eb360ba152e8f833f211657c03a9be8e
SHA512 1812b6e5ae35a1f1a6bd7960f26b725f02de2054b6b1f7c8d60903248e2eeba9c63ca977bc94aa78f344a5233a8f0e860f60ec44abe5c7cb4df83f77b4db125a
SSDEEP 49152:GNQc7U0SgxsTA9zil8QTGT/2XLQlqxP1cN/tZmC:wXU0SisM9WHitz
TLSH
T1CE956C1AA77AF2D8C27BA0389490595FD9B378184BB056DF839047090E27FD49F3E726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-20_da765e57d67e2ad5f68d81a779d01f20_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-09-20_da765e57d67e2ad5f68d81a779d01f20_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 1.9MB

2026-09-20_da765e57d67e2ad5f68d81a779d01f20_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 4a36bdc0e9acb57b3de15b1c9077fb08
SHA256 f640525d917bc7acea9db71a5e1a9a471821d073349eb8bfa6e1a78365259d79
MD5 da765e57d67e2ad5f68d81a779d01f20
SHA1 ede8e281eb360ba152e8f833f211657c03a9be8e
SHA512 1812b6e5ae35a1f1a6bd7960f26b725f02de2054b6b1f7c8d60903248e2eeba9c63ca977bc94aa78f344a5233a8f0e860f60ec44abe5c7cb4df83f77b4db125a
SSDEEP 49152:GNQc7U0SgxsTA9zil8QTGT/2XLQlqxP1cN/tZmC:wXU0SisM9WHitz
TLSH
T1CE956C1AA77AF2D8C27BA0389490595FD9B378184BB056DF839047090E27FD49F3E726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\ws\workspace\OSCE\OSCE_Common_Onpremise_2019_SP1R2_REL\build\src\tool\RPDownloader\x64\Release\SupportConnector_x64.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

IsValidSid OpenProcessToken EqualSid GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegQueryValueExA RegSetValueExA ImpersonateLoggedOnUser RevertToSelf LookupAccountSidW CryptDeriveKey CryptAcquireContextW CreateWellKnownSid RegCreateKeyExA CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptImportKey CryptGetHashParam CryptSetKeyParam CryptDestroyKey CryptReleaseContext CryptAcquireContextA RegOpenKeyExA

shlwapi

PathRemoveFileSpecW PathCanonicalizeW PathStripPathW PathFileExistsA PathAppendW PathFileExistsW

rpcrt4

UuidToStringW RpcStringFreeW

winhttp

WinHttpQueryAuthSchemes WinHttpSetCredentials WinHttpReadData WinHttpSetStatusCallback WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest

kernel32

FreeLibrary LoadLibraryW GetSystemDirectoryA GetSystemDirectoryW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetACP LoadLibraryA GlobalFree OpenProcess WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW DecodePointer RaiseException HeapDestroy HeapReAlloc HeapSize InitializeCriticalSectionEx DeleteCriticalSection DeleteFileA GetTempPathA GetTempFileNameA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CreateFileA WriteFile LocalFree GetCurrentDirectoryW CreateDirectoryW FileTimeToLocalFileTime GetFileTime GetTempFileNameW LocalFileTimeToFileTime SetFileTime GetTempPathW ReleaseMutex WaitForSingleObject WaitForSingleObjectEx GetWindowsDirectoryW CopyFileW FileTimeToSystemTime SystemTimeToFileTime GetSystemTimeAsFileTime GetCurrentProcessId GetVersionExW LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW WaitForMultipleObjects GetExitCodeProcess CreateProcessW SystemTimeToTzSpecificLocalTime MoveFileExW TryEnterCriticalSection InitializeSRWLock QueryFullProcessImageNameA OpenMutexA GetSystemWow64DirectoryA GetWindowsDirectoryA GetSystemTime ProcessIdToSessionId TerminateThread CreateThread CreateMutexA GetCurrentThreadId GetModuleFileNameA lstrlenA CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateEventW CreateMutexW GetProcessHeap HeapFree HeapAlloc GetLastError CloseHandle GetModuleHandleA GetProcAddress GetSystemInfo SwitchToThread GetTickCount GetModuleHandleW GetVolumePathNamesForVolumeNameW QueryDosDeviceW GetLongPathNameW GetDriveTypeA FindVolumeClose FindNextVolumeW FindFirstVolumeW FindFirstFileA Sleep RtlUnwind ExitThread FreeLibraryAndExitThread CreateFileW DeleteFileW GetFileSizeEx ReadFile LocalAlloc QueryFullProcessImageNameW SetLastError SetEvent GetFileSize CreateFileMappingA GetLocalTime GetVersionExA ReleaseSemaphore WaitForMultipleObjectsEx CreateEventA FormatMessageA CreateSemaphoreA GetStringTypeW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW SetEndOfFile SetFileInformationByHandle SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive EncodePointer LCMapStringEx GetCPInfo InitializeSListHead InitializeCriticalSectionAndSpinCount ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter OutputDebugStringW InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceFrequency ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleCP GetConsoleMode ReadConsoleW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle WriteConsoleW GetCurrentProcess SetNamedPipeHandleState WaitNamedPipeW ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetOverlappedResult SetWaitableTimer

shell32

SHGetFolderPathW

ole32

CoUninitialize CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoCreateGuid

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

crypt32

CryptProtectData CryptUnprotectData CryptSIPRetrieveSubjectGuidForCatalogFile CryptMsgUpdate CryptMsgOpenToDecode CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptMsgControl CryptMsgGetParam CryptMsgClose CryptDecodeObject

wtsapi32

WTSQueryUserToken

urlmon

URLDownloadToFileA

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrust CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle CryptCATCatalogInfoFromContext CryptSIPGetSignedDataMsg CryptSIPVerifyIndirectData CryptCATAdminReleaseContext

psapi

EnumProcessModulesEx GetModuleFileNameExA

dbghelp

ImageNtHeader

Name

.text

Size

892KB

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

307KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

553KB

Virtual Size

553KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=13, id=259, version=25203,

count=19, id=260, version=25203,

count=199, id=261, version=25203,

count=1, id=135, version=30729,

count=1, id=136, version=30729,

count=4, id=253, version=28518,

count=18, id=260, version=30034,

count=10, id=259, version=30034,

count=103, id=261, version=30034,

count=31, id=261, version=27049,

count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=382, id=1, productName=Unmarked objects,

count=8, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=23, id=261, version=30148,

count=1, id=255, version=30148,

count=1, id=151,

count=1, id=258, version=30148,