2026-09-24_6cf01383b55c3876b4210178633e11a4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_6cf01383b55c3876b4210178633e11a4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 1.3MB
Sample260925-jjd49swsdv
SHA256 c5aeeb6d7b7810062c3af57e58b3985685174ea3a38bcc16fca8b06ab45337bc
MD5 6cf01383b55c3876b4210178633e11a4
SHA1 3b98b2c986566f2239a2b2d0f530c9df261a150f
SHA512 fd02559d610edd192ad2c0f06dfd0cef567e145c8ec5ee16fa1db2e95375dab874514037fd0c23e4df02d0e23aaa3778bc8922a896d124bcb586b7073da188b6
SSDEEP 12288:vrP6JS6jd1i6KiXaMTcjxaulMXWMuL5uFpXbiTvbsq6rxadAjoH+PICvb3RZUE5P:zyXTc8UMXWpss6FaW24UVS
TLSH
T11E558D16A29801FCD1B7D1B8CA67890AE77278454334ABEF27DC56621F136D89E3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_6cf01383b55c3876b4210178633e11a4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-09-24_6cf01383b55c3876b4210178633e11a4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 1.3MB

2026-09-24_6cf01383b55c3876b4210178633e11a4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 7bbfd5c5dbdf618696709760a9a3e055
SHA256 c5aeeb6d7b7810062c3af57e58b3985685174ea3a38bcc16fca8b06ab45337bc
MD5 6cf01383b55c3876b4210178633e11a4
SHA1 3b98b2c986566f2239a2b2d0f530c9df261a150f
SHA512 fd02559d610edd192ad2c0f06dfd0cef567e145c8ec5ee16fa1db2e95375dab874514037fd0c23e4df02d0e23aaa3778bc8922a896d124bcb586b7073da188b6
SSDEEP 12288:vrP6JS6jd1i6KiXaMTcjxaulMXWMuL5uFpXbiTvbsq6rxadAjoH+PICvb3RZUE5P:zyXTc8UMXWpss6FaW24UVS
TLSH
T11E558D16A29801FCD1B7D1B8CA67890AE77278454334ABEF27DC56621F136D89E3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

753296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateIoCompletionPort GetQueuedCompletionStatus InitializeCriticalSectionAndSpinCount SleepEx CreateEventW SetWaitableTimer CreateWaitableTimerA GetCurrentThreadId CreateToolhelp32Snapshot Process32FirstW Process32NextW MultiByteToWideChar GetFileAttributesA TerminateProcess CreateProcessA OpenProcess GetEnvironmentVariableA GetTempPathA GetCurrentProcessId ExitProcess GetModuleFileNameW QueryFullProcessImageNameA GetComputerNameW SetEndOfFile WriteConsoleW CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc SetLastError ReadConsoleW WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetModuleFileNameA TerminateThread QueueUserAPC WaitForMultipleObjects SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetProcAddress GetCurrentProcess WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread CreateEventA CreateMutexA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CloseHandle PostQueuedCompletionStatus GetLastError GetTimeZoneInformation IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry GetModuleHandleW RtlPcToFileHeader RaiseException WaitForSingleObjectEx Sleep GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind

user32

FindWindowA SetWinEventHook SetWindowLongA GetWindowLongA GetWindowRect SetWindowPos PeekMessageA AttachThreadInput ShowWindow IsIconic BringWindowToTop GetForegroundWindow DispatchMessageA GetWindowTextA SetForegroundWindow EnumWindows GetWindowThreadProcessId GetWindow

advapi32

RegCloseKey RegNotifyChangeKeyValue RegOpenKeyExA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegDeleteValueA

shell32

ShellExecuteA

ws2_32

getaddrinfo WSAGetLastError WSASetLastError shutdown setsockopt select getsockopt ioctlsocket connect WSASend WSACleanup WSAStartup freeaddrinfo accept bind htonl htons listen ntohl WSAStringToAddressW closesocket WSASocketW WSARecv

bcrypt

BCryptDestroyKey BCryptCreateHash BCryptEncrypt BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

wininet

InternetSetOptionA

crypt32

CertOpenStore CertFindCertificateInStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateContextProperty CertAddCertificateContextToStore CertDeleteCertificateFromStore CryptUnprotectData CertCloseStore PFXImportCertStore

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpOpenRequest

Name

.text

Size

968KB

Virtual Size

967KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

309KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_6cf01383b55c3876b4210178633e11a4_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

wininet

crypt32

winhttp

generic