2026-09-26_899670d796fbb6fdddad2e6b75a5dc96_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_899670d796fbb6fdddad2e6b75a5dc96_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar
Size 1.3MB
Sample260926-xtcwva1xft
SHA256 1edfcf858796a2b8ab01b9aa29a805a134aab39504dbb82ef4601887b2cadd72
MD5 899670d796fbb6fdddad2e6b75a5dc96
SHA1 cda7e6a516925327d73b771d143d934432ad823a
SHA512 f532753489478655b0bc9bda1165812e03cebc9729a340ecfdd6832e2333749fe3cd3f2c58263b570d4d47b8d55d3db2a033f999ab93fd843b397c0ecbf42d98
SSDEEP 24576:whbmvdnArJ02KtQh+OdL80047Xc1eR8HXFzzs:AKBmJciTv97Xc1e+FXs
TLSH
T1F3555B5FB76800E8D1BEE13C86569D4AE7B1784A03A0E7CF12A406576F27BE45E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_899670d796fbb6fdddad2e6b75a5dc96_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-09-26_899670d796fbb6fdddad2e6b75a5dc96_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

.exe 1.3MB

2026-09-26_899670d796fbb6fdddad2e6b75a5dc96_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

IMPHASH 009eda380a08881f40872e93a2b88ddc
SHA256 1edfcf858796a2b8ab01b9aa29a805a134aab39504dbb82ef4601887b2cadd72
MD5 899670d796fbb6fdddad2e6b75a5dc96
SHA1 cda7e6a516925327d73b771d143d934432ad823a
SHA512 f532753489478655b0bc9bda1165812e03cebc9729a340ecfdd6832e2333749fe3cd3f2c58263b570d4d47b8d55d3db2a033f999ab93fd843b397c0ecbf42d98
SSDEEP 24576:whbmvdnArJ02KtQh+OdL80047Xc1eR8HXFzzs:AKBmJciTv97Xc1e+FXs
TLSH
T1F3555B5FB76800E8D1BEE13C86569D4AE7B1784A03A0E7CF12A406576F27BE45E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1298432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dbghelp

MiniDumpWriteDump SymInitialize SymGetModuleBase64 SymFunctionTableAccess64 StackWalk64

kernel32

WriteConsoleW HeapSize SetStdHandle GetProcessHeap GetCurrentThread FreeLibrary GetProcAddress LoadLibraryA VerSetConditionMask GetModuleHandleExW VerifyVersionInfoW GetModuleFileNameW GetModuleHandleW LoadLibraryW GetCommandLineW CreateFileW CloseHandle SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetLastError SetEvent WaitForSingleObject CreateEventW Sleep CreateThread GetTickCount64 DuplicateHandle RaiseException CreateMutexA GetExitCodeProcess OpenProcess ReleaseMutex MapViewOfFile UnmapViewOfFile OpenMutexA CreateFileMappingA OpenFileMappingA lstrlenA SetLastError FormatMessageA SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery LoadLibraryExA LoadLibraryExW GetSystemInfo FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW GetFileSizeEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapAlloc HeapFree WriteFile GetStdHandle ExitProcess TlsFree LocalFree CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFileInformationByHandle SetFilePointerEx AreFileApisANSI RtlUnwind GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte RtlPcToFileHeader WaitForSingleObjectEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW IsProcessorFeaturePresent QueryPerformanceCounter EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess InitializeCriticalSectionAndSpinCount ResetEvent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx TlsAlloc TlsGetValue TlsSetValue

user32

RegisterRawInputDevices GetRawInputDeviceList GetAncestor CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SetWindowTextW RemovePropW GetPropW SetPropW MapVirtualKeyW IsWindow CallWindowProcW PostQuitMessage DefRawInputProc GetRawInputDeviceInfoW TranslateMessage SetWindowLongPtrW GetWindowLongPtrW DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW PeekMessageW DispatchMessageW GetRawInputData

shell32

SHGetFolderPathW

d3d11

D3D11CreateDevice

Name

.text

Size

622KB

Virtual Size

621KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

199KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdfca

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_899670d796fbb6fdddad2e6b75a5dc96_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar

dbghelp

kernel32

user32

shell32

d3d11

generic