2026-10-02_eb3c619441272d7370a241764cdda97a_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_eb3c619441272d7370a241764cdda97a_cobalt-strike_glassworm_icedid_njrat_satacom
Size 2.0MB
Sample261002-2967vaaa55
SHA256 af7ccf20ea7c7230f0e201bc2df1444f0d2c60e26474145e2bc2d0102f1bfb0b
MD5 eb3c619441272d7370a241764cdda97a
SHA1 1e4a47fd3dd56ecc9a550ad1c8123a57df19dc93
SHA512 d4a421c988a464fc390a556d0b8d6a2a2e2deb8ec9e94f413c01f5adea1ea9dcbbd2ba1aeb9d46e656070c9af2eb511a88c0aa2bf50c469e1aaac911a5effd3e
SSDEEP 49152:87L9jLR+JIieraYRrY7HdbGYI0vp2Xvh+5PnQmUH1vvOK23Ea5A:eRN5OHxGYIY2XvhinOVvvOh0h
TLSH
T1D3A58D17A6B900EDD167C179CA165903EB72B4060734ABDF1390CE662F63BE15BBE720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-02_eb3c619441272d7370a241764cdda97a_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-10-02_eb3c619441272d7370a241764cdda97a_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 2.0MB

2026-10-02_eb3c619441272d7370a241764cdda97a_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH 24104e84d0b0e13ac80e629fd150c29e
SHA256 af7ccf20ea7c7230f0e201bc2df1444f0d2c60e26474145e2bc2d0102f1bfb0b
MD5 eb3c619441272d7370a241764cdda97a
SHA1 1e4a47fd3dd56ecc9a550ad1c8123a57df19dc93
SHA512 d4a421c988a464fc390a556d0b8d6a2a2e2deb8ec9e94f413c01f5adea1ea9dcbbd2ba1aeb9d46e656070c9af2eb511a88c0aa2bf50c469e1aaac911a5effd3e
SSDEEP 49152:87L9jLR+JIieraYRrY7HdbGYI0vp2Xvh+5PnQmUH1vvOK23Ea5A:eRN5OHxGYIY2XvhinOVvvOh0h
TLSH
T1D3A58D17A6B900EDD167C179CA165903EB72B4060734ABDF1390CE662F63BE15BBE720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b6:6c:33:a7:9b:dc:e6:df:a9:6c:56:9b:72:e2:55:1f:0c:8e:00:be:43:7c:d4:5e:f5:6c:45:3f:95:68:52:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation

Chains

Oct 1, 2026

CN=Microsoft Corporation

Subject

CN=Microsoft Corporation

Serial Number

16:f5:fe:87:83:1f:bf:b2:4b:5c:89:6b:22:00:c9:73

Issuer

CN=Microsoft Corporation

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2026 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1370896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider

ole32

CoTaskMemFree CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetKnownFolderPath

advapi32

RegGetValueW CheckTokenMembership FreeSid AllocateAndInitializeSid

ws2_32

WSAStartup htonl listen recv bind select closesocket htons send WSACleanup __WSAFDIsSet socket setsockopt accept

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpOpen

gdi32

CreateCompatibleBitmap DeleteDC DeleteObject SelectObject BitBlt CreateCompatibleDC

user32

GetDC ReleaseDC GetSystemMetrics

gdiplus

GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize

kernel32

SetFilePointerEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW ReadConsoleW GetExitCodeProcess GetTimeZoneInformation IsValidCodePage GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetACP TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW LoadLibraryExW RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetModuleHandleExW CloseThreadpoolWork GetStdHandle GetFileType GetTempPathW GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GlobalMemoryStatusEx GetSystemInfo GetTickCount VirtualProtect GetModuleFileNameA GetModuleHandleA LoadResource LockResource SizeofResource FindResourceA GetEnvironmentVariableW GetFileSizeEx GetFinalPathNameByHandleW ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe CreateNamedPipeW WaitForSingleObject CreateEventW TerminateProcess CreateRemoteThread CreateProcessW OpenProcess GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW LocalFree SetDllDirectoryW GetComputerNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualQueryEx ReadProcessMemory Process32First Process32Next FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetExitCodeThread GetLogicalProcessorInformationEx GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 CopyFile2 GetFileInformationByHandleEx RtlPcToFileHeader GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_eb3c619441272d7370a241764cdda97a_cobalt-strike_glassworm_icedid_njrat_satacom

PE Signature issue

crypt32

bcrypt

ole32

shell32

advapi32

ws2_32

oleaut32

winhttp

gdi32

user32

gdiplus

kernel32

generic