2026-10-01_ba6e31ca7fb865f0acb8ae2ac4fc9883_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_ba6e31ca7fb865f0acb8ae2ac4fc9883_cobalt-strike_glassworm_icedid_njrat_satacom
Size 2.0MB
Sample261002-e7b8csvemf
SHA256 68f9dab114b513ab348bef47573a04c6549318623e2e95ce196b875aac3a3724
MD5 ba6e31ca7fb865f0acb8ae2ac4fc9883
SHA1 5a11219ecc48c1fdc546d35304f2cb7bf213e7be
SHA512 20c2390838d9c2008a2d3cb0024851f32fce5c29a842cdbd4f956957d6b5696c463a80429d83bac847a73604c69124c45478e4ccec337dc36af0a80ea0ce7ba1
SSDEEP 49152:/QkZuanKe6gjnwNeEL4saQGmjGIGxUMRWTyg9K2Cvgzg6HpX:1P/CPaQGmjoxUMRZg7CvgcUpX
TLSH
T178A58D17B2B900EDD167C27DCA065A07EB72B4050734ABDF13908A662F27AE15F7E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-01_ba6e31ca7fb865f0acb8ae2ac4fc9883_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-10-01_ba6e31ca7fb865f0acb8ae2ac4fc9883_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 2.0MB

2026-10-01_ba6e31ca7fb865f0acb8ae2ac4fc9883_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH 0cbc734fe65514278085c6a10392b8ba
SHA256 68f9dab114b513ab348bef47573a04c6549318623e2e95ce196b875aac3a3724
MD5 ba6e31ca7fb865f0acb8ae2ac4fc9883
SHA1 5a11219ecc48c1fdc546d35304f2cb7bf213e7be
SHA512 20c2390838d9c2008a2d3cb0024851f32fce5c29a842cdbd4f956957d6b5696c463a80429d83bac847a73604c69124c45478e4ccec337dc36af0a80ea0ce7ba1
SSDEEP 49152:/QkZuanKe6gjnwNeEL4saQGmjGIGxUMRWTyg9K2Cvgzg6HpX:1P/CPaQGmjoxUMRZg7CvgcUpX
TLSH
T178A58D17B2B900EDD167C27DCA065A07EB72B4050734ABDF13908A662F27AE15F7E724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3a:92:e4:8b:6a:85:39:91:55:a5:24:72:1a:c3:80:77:2d:cf:56:19:a9:ee:5f:d5:f5:db:03:32:ed:9a:4f:c8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation

Chains

Oct 1, 2026

CN=Microsoft Corporation

Subject

CN=Microsoft Corporation

Serial Number

1b:a5:70:4b:4f:db:db:9a:42:f3:8a:ec:18:52:be:e6

Issuer

CN=Microsoft Corporation

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2026 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1345408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider

ole32

CoTaskMemFree CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetKnownFolderPath

advapi32

RegGetValueW CheckTokenMembership FreeSid AllocateAndInitializeSid

ws2_32

WSAStartup htonl listen recv bind select closesocket htons send WSACleanup __WSAFDIsSet socket setsockopt accept

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

winhttp

WinHttpCrackUrl WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpOpen

gdi32

CreateCompatibleBitmap DeleteDC DeleteObject SelectObject BitBlt CreateCompatibleDC

user32

GetDC ReleaseDC GetSystemMetrics

gdiplus

GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize

kernel32

SetFilePointerEx GetConsoleMode GetConsoleOutputCP ReadConsoleW GetExitCodeProcess GetTimeZoneInformation IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetACP LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetDateFormatW RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetModuleHandleExW GetStdHandle GetFileType GetTempPathW Sleep GetCurrentProcessId GetEnvironmentVariableW GetFileSizeEx GetFinalPathNameByHandleW ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe CreateNamedPipeW WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess CreateRemoteThread GetCurrentThreadId CreateProcessW OpenProcess GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW LocalFree SetDllDirectoryW GetComputerNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualQueryEx ReadProcessMemory Process32First Process32Next FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetExitCodeThread GetLogicalProcessorInformationEx GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 CopyFile2 GetFileInformationByHandleEx RtlPcToFileHeader GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_ba6e31ca7fb865f0acb8ae2ac4fc9883_cobalt-strike_glassworm_icedid_njrat_satacom

PE Signature issue

crypt32

bcrypt

ole32

shell32

advapi32

ws2_32

oleaut32

winhttp

gdi32

user32

gdiplus

kernel32

generic