2026-09-27_c04ee54605d989881e34ed97328877ed_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

General

Target
2026-09-27_c04ee54605d989881e34ed97328877ed_cobalt-strike_glassworm_icedid_satacom_stealc_vidar
Size 257KB
Sample260928-xwp9yscf98
SHA256 6382715ac544fbb30e5691e541cde085770a1e22311b9702a8603f9629e1768e
MD5 c04ee54605d989881e34ed97328877ed
SHA1 31528a879738eaf1d51a78bc3182f0cde5479df3
SHA512 3489fc0ee5966e32114b769c9c826363a9e856c589fce471f7b1e3b24545cb46cca123896d2f3268edddf6915802e2ffab983715de7c79770dd99db320d142e2
SSDEEP 6144:lyPgc1lwIx8jbsd4DKFugOnwqeYxohGK:lWT0lSO3o
TLSH
T168446B1A32A90CF8EDB7813DC9425A46E672B81607B0D6EF07A043675F276D09D3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_c04ee54605d989881e34ed97328877ed_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

File Explorer

2026-09-27_c04ee54605d989881e34ed97328877ed_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

.exe 257KB

2026-09-27_c04ee54605d989881e34ed97328877ed_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

IMPHASH 006572e9009ec6d03cc9f702cce285da
SHA256 6382715ac544fbb30e5691e541cde085770a1e22311b9702a8603f9629e1768e
MD5 c04ee54605d989881e34ed97328877ed
SHA1 31528a879738eaf1d51a78bc3182f0cde5479df3
SHA512 3489fc0ee5966e32114b769c9c826363a9e856c589fce471f7b1e3b24545cb46cca123896d2f3268edddf6915802e2ffab983715de7c79770dd99db320d142e2
SSDEEP 6144:lyPgc1lwIx8jbsd4DKFugOnwqeYxohGK:lWT0lSO3o
TLSH
T168446B1A32A90CF8EDB7813DC9425A46E672B81607B0D6EF07A043675F276D09D3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW

kernel32

GetCurrentThreadId WriteConsoleW GetDriveTypeW GetFileAttributesW GetLogicalDrives SetFileAttributesW WideCharToMultiByte LocalFree FormatMessageA CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx CloseHandle GetLastError GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId RtlUnwind GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess HeapSize RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_c04ee54605d989881e34ed97328877ed_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

shell32

kernel32

generic