2026-09-24_4d6ce7290d44e50ffe43e93cf4dfb6ab_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_4d6ce7290d44e50ffe43e93cf4dfb6ab_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 4.4MB
Sample260925-md1b4azscv
SHA256 de92ce2878d925443ce9fc661ade90e153ebeb1d3e8562a9c178fb9c16a3d7b1
MD5 4d6ce7290d44e50ffe43e93cf4dfb6ab
SHA1 12da25194e95ff5a8d7f7fda90de3c8218ff3fa1
SHA512 878d48e8caf7a1b90d4d63ce97ec49970ef8f519333c7129ad8bbe2c833c300fc19a1ff91c228e432c0e9e0d89d39e09a3dc26ad2b9a4dabc9cb831bfaa945be
SSDEEP 49152:7pe4sTsOSlabT6rHl3X/MnHataT8+HEfmxmmNvRiTOymLqLwE8XEFgtD1nS7SRCw:9eRSPrF3LYiToyFEDRCK6epl
TLSH
T17E26BE07E36242B8C526D47CC652C323F7717C081B24A6DBAB941F565FA76F02EBA394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_4d6ce7290d44e50ffe43e93cf4dfb6ab_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-09-24_4d6ce7290d44e50ffe43e93cf4dfb6ab_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 4.4MB

2026-09-24_4d6ce7290d44e50ffe43e93cf4dfb6ab_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 3e32a2fd092761f801dc97356cad739d
SHA256 de92ce2878d925443ce9fc661ade90e153ebeb1d3e8562a9c178fb9c16a3d7b1
MD5 4d6ce7290d44e50ffe43e93cf4dfb6ab
SHA1 12da25194e95ff5a8d7f7fda90de3c8218ff3fa1
SHA512 878d48e8caf7a1b90d4d63ce97ec49970ef8f519333c7129ad8bbe2c833c300fc19a1ff91c228e432c0e9e0d89d39e09a3dc26ad2b9a4dabc9cb831bfaa945be
SSDEEP 49152:7pe4sTsOSlabT6rHl3X/MnHataT8+HEfmxmmNvRiTOymLqLwE8XEFgtD1nS7SRCw:9eRSPrF3LYiToyFEDRCK6epl
TLSH
T17E26BE07E36242B8C526D47CC652C323F7717C081B24A6DBAB941F565FA76F02EBA394
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1506944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\weall\Desktop\SRCs And Features\bloom external src\bloom external src\x64\Release\sora.pdb

d3dx9_43

D3DXVec3Transform D3DXVec3Normalize D3DXMatrixTranspose

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

VerSetConditionMask FreeLibrary QueryPerformanceCounter DeleteFileA SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId SetThreadPriority GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA EnterCriticalSection WriteFile LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetCurrentProcess SetThreadAffinityMask PeekNamedPipe WaitForMultipleObjects SetLastError GetLocaleInfoA GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW WideCharToMultiByte GlobalFree QueryPerformanceFrequency MultiByteToWideChar GetLocalTime GetCurrentThread CreateFileA GetLastError CreateRemoteThread GetModuleHandleW ExitProcess GlobalLock GetProcAddress Process32FirstW GlobalAlloc LoadLibraryA K32GetProcessMemoryInfo Process32NextW Sleep WaitForSingleObject GetTempPathA FormatMessageA WriteProcessMemory ReadProcessMemory VirtualProtectEx CloseHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleA CreateToolhelp32Snapshot OpenProcess Module32First Module32Next VirtualFreeEx VirtualAllocEx GetFileInformationByHandleEx LocalFree GetLocaleInfoEx WakeAllConditionVariable GetFileType GetStartupInfoW

user32

mouse_event GetClipboardData TranslateMessage GetAsyncKeyState GetForegroundWindow SetClipboardData GetClientRect SetLayeredWindowAttributes MapVirtualKeyA SetWindowDisplayAffinity IsChild PeekMessageW EmptyClipboard CloseClipboard GetMonitorInfoW DispatchMessageW OpenClipboard GetKeyNameTextA ShowWindow RegisterClassExW CreateWindowExW EnumDisplayMonitors MonitorFromWindow DestroyWindow LoadCursorA DefWindowProcW SetForegroundWindow UpdateWindow FindWindowA PostQuitMessage GetWindowLongPtrA PeekMessageA DefWindowProcA MoveWindow MessageBoxA SetWindowLongA UnregisterClassW SetWindowPos GetWindowRect DispatchMessageA GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo LoadIconA GetSystemMetrics GetKeyState

gdi32

GetStockObject

advapi32

CryptAcquireContextA CryptGetHashParam CryptGenRandom CryptCreateHash GetTokenInformation OpenProcessToken AdjustTokenPrivileges RegGetValueA CryptHashData CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptReleaseContext

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Xtime_get_ticks ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringW _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

winhttp

WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

ws2_32

recv closesocket send WSAGetLastError bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket gethostname sendto recvfrom freeaddrinfo getaddrinfo __WSAFDIsSet ntohl select

normaliz

IdnToAscii

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore CertCloseStore CertFreeCertificateChain

wldap32

ord143 ord217 ord46 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

winmm

timeBeginPeriod

dwmapi

DwmUpdateThumbnailProperties DwmRegisterThumbnail DwmExtendFrameIntoClientArea DwmUnregisterThumbnail

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __intrinsic_setjmp __current_exception __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler __std_type_info_compare memcmp __RTtypeid strstr strrchr longjmp memcpy memmove memset memchr strchr

api-ms-win-crt-heap-l1-1-0

_callnewh realloc free malloc _set_new_mode calloc

api-ms-win-crt-string-l1-1-0

tolower isupper _stricmp strspn strcspn _wcsicmp strncpy_s strcat_s wcslen strpbrk _strdup toupper strncmp strcmp strlen strncpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf fwrite setvbuf fgets fsetpos __stdio_common_vsscanf __stdio_common_vfprintf __stdio_common_vsprintf_s _fseeki64 _get_stream_buffer_pointers _lseeki64 __stdio_common_vsnprintf_s fflush _wfopen _set_fmode __acrt_iob_func fputc __p__commode fgetpos fputs fopen _read fread feof ungetc _write fgetc fseek _open fclose ftell _close

api-ms-win-crt-convert-l1-1-0

strtoll wcstol strtol atoi strtoull strtod strtoul

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _errno __sys_nerr exit strerror _register_thread_local_exe_atexit_callback _c_exit _register_onexit_function _cexit _getpid _exit _initterm_e _initterm _get_narrow_winmain_command_line _beginthreadex _crt_atexit terminate abort _seh_filter_exe _set_app_type

api-ms-win-crt-math-l1-1-0

ceilf cosf _dsign fmodf __setusermatherr _hypotf acosf sqrtf powf sinf

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 strftime _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_stat64 _access _fstat64 _lock_file _unlock_file _unlink

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-utility-l1-1-0

qsort

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_4d6ce7290d44e50ffe43e93cf4dfb6ab_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3dx9_43

d3dx11_43

d3d11

kernel32

user32

gdi32

advapi32

msvcp140

winhttp

ws2_32

normaliz

crypt32

wldap32

ntdll

winmm

dwmapi

imm32

d3dcompiler_43

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic