2026-09-29_395f9a61a75825e79056ef3fb7117503_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_395f9a61a75825e79056ef3fb7117503_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 8.8MB
Sample260930-dgfx7asbkb
SHA256 1e416077925b303e99d6b82f063b6fed0a5e0ae637f232384f824f17ba3d6f53
MD5 395f9a61a75825e79056ef3fb7117503
SHA1 e385957e9c6695ca138a5904aa62fdae6d399345
SHA512 ed05812fec199d1131e2f17eea0b5cc342d42a9afdee41e9ad90ab2761e8d320a9874478665dd2b4feff096c9d0d9a6a11fd846dee2c12defff029dbca140e4a
SSDEEP 98304:kLklromAH3aFFmDGPtP61rp05Nj1Kroodfp2MI:kkUup615VI
TLSH
T15396BE43F2E708E9D677927CC6975327E7B0B81803355BDB27908A626F53AD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_395f9a61a75825e79056ef3fb7117503_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-09-29_395f9a61a75825e79056ef3fb7117503_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 8.8MB

2026-09-29_395f9a61a75825e79056ef3fb7117503_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 5ab4669a42d0693d86daf369d0ad9291
SHA256 1e416077925b303e99d6b82f063b6fed0a5e0ae637f232384f824f17ba3d6f53
MD5 395f9a61a75825e79056ef3fb7117503
SHA1 e385957e9c6695ca138a5904aa62fdae6d399345
SHA512 ed05812fec199d1131e2f17eea0b5cc342d42a9afdee41e9ad90ab2761e8d320a9874478665dd2b4feff096c9d0d9a6a11fd846dee2c12defff029dbca140e4a
SSDEEP 98304:kLklromAH3aFFmDGPtP61rp05Nj1Kroodfp2MI:kkUup615VI
TLSH
T15396BE43F2E708E9D677927CC6975327E7B0B81803355BDB27908A626F53AD0AE79700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\tobia\Desktop\New Era\x64\Release\loader.pdb

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryA

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd

kernel32

CopyFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap CreateFileMappingA CreateProcessW GetTickCount64 CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW GetExitCodeProcess GetCurrentProcessId GetCurrentProcess Sleep CreateEventW CreateMutexW WaitForSingleObject QueryPerformanceCounter GetLastError CloseHandle GetTempPathW WriteFile GetTempFileNameW GetFileAttributesW DeleteFileW InitOnceBeginInitialize InitOnceComplete SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime FormatMessageA LocalFree FindResourceW SizeofResource LockResource CreateFileW InitializeSListHead LoadResource GetModuleHandleW FindResourceA

user32

ClientToScreen SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData LoadCursorA OpenClipboard GetWindowThreadProcessId GetClassNameW EnumWindows FindWindowA GetCursorPos MonitorFromWindow SetProcessDPIAware ScreenToClient MessageBoxW GetWindowRect SetWindowRgn UpdateWindow GetSystemMetrics SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage CloseClipboard

gdi32

GetDeviceCaps DeleteObject CreateRectRgn CreateRoundRectRgn

advapi32

CryptEncrypt CryptImportKey CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey ConvertSidToStringSidA GetTokenInformation OpenProcessToken CryptGenRandom

shell32

ShellExecuteA

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ

ws2_32

recvfrom getsockname getsockopt sendto getpeername connect bind htons ntohs WSAGetLastError send setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept freeaddrinfo listen ioctlsocket __WSAFDIsSet recv closesocket htonl gethostname select getaddrinfo ntohl

normaliz

IdnToUnicode IdnToAscii

wldap32

ord200 ord30 ord79 ord35 ord33 ord32 ord301 ord143 ord217 ord46 ord211 ord27 ord60 ord45 ord50 ord41 ord26 ord22

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetColorizationColor DwmIsCompositionEnabled

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

vcruntime140

strrchr __C_specific_handler strstr memset longjmp __intrinsic_setjmp __current_exception __current_exception_context __std_type_info_destroy_list memmove strchr __std_terminate wcsrchr wcsstr __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memchr memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcmp strncpy strncmp isxdigit strpbrk isalnum strcspn strspn isupper tolower _strdup _wcsicmp wcslen strlen strnlen _stricmp _strnicmp

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _crt_atexit _get_narrow_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _execute_onexit_table _initialize_onexit_table _initialize_narrow_environment _errno _configure_narrow_argv _beginthreadex _getpid __sys_nerr _crt_at_quick_exit strerror abort _register_onexit_function _seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode realloc free malloc calloc

api-ms-win-crt-convert-l1-1-0

atof atoi strtod strtoull strtol strtoll strtoul

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _open _close __stdio_common_vsprintf _write __stdio_common_vsprintf_s _read __acrt_iob_func __p__commode _set_fmode _wfopen fclose fflush fread _lseeki64 fseek fgets fputc ftell feof fwrite fputs fopen __stdio_common_vfprintf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

sinf sqrtf acosf _dclass ceilf powf atan2f log logf cosf pow fmodf __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_stat64 _fstat64 _access _unlink

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

961KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

734KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_395f9a61a75825e79056ef3fb7117503_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3dx11_43

d3d11

d3dcompiler_47

bcrypt

crypt32

vmprotectsdk64

kernel32

user32

gdi32

advapi32

shell32

msvcp140

ws2_32

normaliz

wldap32

dwmapi

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic