2026-10-01_a41cddacd9c6fde28453a46dd99cd281_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_a41cddacd9c6fde28453a46dd99cd281_cobalt-strike_glassworm_icedid_njrat_satacom
Size 18.6MB
Sample261002-htmzgsvbjg
SHA256 32d03a144806bf81299981e1a7012df38c97a31b11d11faf0c860052c742e83a
MD5 a41cddacd9c6fde28453a46dd99cd281
SHA1 699193314d1f80eb20cafbe955adcec4f8430e6e
SHA512 e40a646850be1d44a5d6c38c4c57ce9f23c4cf90496c0f67590e3a084f612da8079c80b1d8ef40a69b2850588acefff3c9b27666a046e74fb8c2bfb0428cf00b
SSDEEP 98304:DtjcjdD14azs3yDIGGie1BIamCtMnGHjYoBMNaM/rQK/OY16Zt+YAe+kCPDuNaB9:JskyUG9eLINONjt8BrQq6ZtXkP+AH4
TLSH
T13C1717217B5A99ADC15AC474834B8A725A3130DB0B35B9FF44C492393F69AF82F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_a41cddacd9c6fde28453a46dd99cd281_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-10-01_a41cddacd9c6fde28453a46dd99cd281_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 18.6MB

2026-10-01_a41cddacd9c6fde28453a46dd99cd281_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH e2a8abd3923b9fde98e4d6ff2bf2e9aa
SHA256 32d03a144806bf81299981e1a7012df38c97a31b11d11faf0c860052c742e83a
MD5 a41cddacd9c6fde28453a46dd99cd281
SHA1 699193314d1f80eb20cafbe955adcec4f8430e6e
SHA512 e40a646850be1d44a5d6c38c4c57ce9f23c4cf90496c0f67590e3a084f612da8079c80b1d8ef40a69b2850588acefff3c9b27666a046e74fb8c2bfb0428cf00b
SSDEEP 98304:DtjcjdD14azs3yDIGGie1BIamCtMnGHjYoBMNaM/rQK/OY16Zt+YAe+kCPDuNaB9:JskyUG9eLINONjt8BrQq6ZtXkP+AH4
TLSH
T13C1717217B5A99ADC15AC474834B8A725A3130DB0B35B9FF44C492393F69AF82F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12717424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

storm_launcher.pdb

rstrtmgr

RmRegisterResources RmEndSession RmGetList RmStartSession

advapi32

RegSetValueExW RegDeleteTreeW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW EventRegister EventSetInformation EventWriteTransfer EventUnregister RegGetValueW RegEnumKeyExW SystemFunction036 OpenProcessToken GetTokenInformation RegDeleteValueW CopySid GetLengthSid IsValidSid LookupAccountSidW

ntdll

NtCreateFile NtQueryInformationProcess NtCreateNamedPipeFile NtDeviceIoControlFile NtReadFile RtlGetVersion NtWriteFile NtQuerySystemInformation RtlNtStatusToDosError NtOpenFile NtCancelIoFileEx

bcryptprimitives

ProcessPrng

kernel32

LoadLibraryW LCMapStringW CompareStringW GetFileAttributesW GetProcessHeap HeapFree LoadLibraryExW FreeLibrary LoadLibraryExA CreateEventW HeapAlloc VirtualProtect IsProcessorFeaturePresent LocalFree GetFileInformationByHandle GetTickCount64 GetLogicalDrives GetDiskFreeSpaceExW HeapSize InitializeSListHead SetConsoleTitleW CreateFileW GetCurrentProcessId FlsGetValue GetStartupInfoW GetSystemTimes GetProcessIoCounters VirtualQueryEx GetSystemTimeAsFileTime GetDriveTypeW GetVolumeInformationW DeviceIoControl SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LCIDToLocaleName GetCPInfo ReleaseSemaphore GetUserDefaultUILanguage MoveFileExW OpenMutexW GetActiveProcessorGroupCount GetActiveProcessorCount lstrcmpiW DuplicateHandle LoadLibraryA RtlUnwindEx GetProcAddress GetModuleHandleA GetProcessTimes SetThreadGroupAffinity OpenThread SetProcessAffinityMask GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx VirtualFreeEx FillConsoleOutputCharacterA QueryFullProcessImageNameW VirtualAllocEx GetFileSizeEx CreateMutexW SetConsoleCP FindNextFileW QueryPerformanceFrequency GetCurrentThreadId SetConsoleOutputCP SetPriorityClass SetConsoleMode GetCurrentProcess GetTempPathW WaitForMultipleObjects GetFileType GetConsoleScreenBufferInfo FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetCurrentDirectoryW SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte GetConsoleMode RtlPcToFileHeader SwitchToThread ExitProcess FindClose FindFirstFileExW CreateIoCompletionPort SetFileCompletionNotificationModes PostQueuedCompletionStatus SetFileAttributesW GetQueuedCompletionStatusEx ReadFile GetOverlappedResult WriteFile RemoveDirectoryW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee GetStdHandle TerminateProcess GetModuleHandleW AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW SetConsoleCtrlHandler Sleep CreateSemaphoreA GetModuleFileNameW GetEnvironmentStringsW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW SetFileTime CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext FlushFileBuffers WriteFileEx SleepEx ReadFileEx CreateThread QueryPerformanceCounter HeapReAlloc CopyFileExW SetFileInformationByHandle GetFullPathNameW SetLastError FreeEnvironmentStringsW CompareStringOrdinal RtlVirtualUnwind WaitForSingleObject GetFileInformationByHandleEx RaiseException SetHandleInformation GetLastError GetModuleHandleExW IsValidCodePage SetConsoleCursorPosition IsThreadAFiber FillConsoleOutputAttribute SetUnhandledExceptionFilter GetProcessHandleCount FormatMessageW GetEnvironmentVariableW GetExitCodeProcess OpenProcess CloseHandle EncodePointer GetACP lstrlenW FlsSetValue InitializeCriticalSectionEx OutputDebugStringW OutputDebugStringA GetOEMCP IsDebuggerPresent CheckRemoteDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ReadProcessMemory CreateToolhelp32Snapshot Process32First Process32Next CreateJobObjectW SetInformationJobObject AssignProcessToJobObject Thread32First Thread32Next GetTimeZoneInformationForYear GlobalMemoryStatusEx SetStdHandle GetCommandLineA GetSystemFirmwareTable UnhandledExceptionFilter GetStringTypeW WriteProcessMemory

ws2_32

ioctlsocket connect getsockopt recv send WSASocketW bind listen WSASend shutdown getaddrinfo freeaddrinfo WSAGetLastError getpeername setsockopt WSAStartup WSAIoctl socket WSACleanup closesocket getsockname accept

shell32

CommandLineToArgvW DragQueryFileW SHGetKnownFolderPath SHAppBarMessage SHGetFolderPathW DragFinish

ole32

RevokeDragDrop CoInitializeSecurity RegisterDragDrop OleInitialize CoUninitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket

user32

ClientToScreen SystemParametersInfoA SendInput GetClientRect MonitorFromWindow ScreenToClient GetMonitorInfoW LoadCursorW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW SetWindowDisplayAffinity PostThreadMessageW RedrawWindow ValidateRect IsWindowVisible GetTouchInputInfo MonitorFromRect SetPropW SetWindowPos SetWindowPlacement GetWindowPlacement GetKeyboardLayout SystemParametersInfoW GetWindowTextLengthW GetWindowLongW GetWindow BringWindowToTop GetMenu SetForegroundWindow IsIconic ShowWindow SendMessageW IsWindow EnumChildWindows EnumWindows MapVirtualKeyExW SetCursor GetKeyState DefWindowProcW ChangeDisplaySettingsExW AdjustWindowRectEx GetCursorPos InvalidateRgn CreateWindowExW RegisterTouchWindow GetWindowLongPtrW DispatchMessageA GetMessageA SetWindowLongPtrW AttachThreadInput GetSystemMetrics PostMessageW ToUnicodeEx TrackMouseEvent IsProcessDPIAware GetWindowRect GetDC RegisterClassExW RegisterWindowMessageA GetClassNameW GetWindowTextW FindWindowW FindWindowExW DestroyWindow GetAsyncKeyState GetKeyboardState GetRawInputData DestroyIcon ShowCursor MessageBoxW ClipCursor GetClipCursor GetActiveWindow SetWindowLongW EnableMenuItem GetSystemMenu GetWindowThreadProcessId ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterRawInputDevices GetMessageW MapVirtualKeyW CloseTouchInputHandle

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

crypt32

CertCloseStore CertOpenSystemStoreW CertDeleteCertificateFromStore CertDuplicateCertificateContext CertFreeCertificateChain CertDuplicateCertificateChain CertFreeCertificateContext CryptStringToBinaryA CertCreateCertificateContext CertDuplicateStore CertAddCertificateContextToStore CertGetNameStringW CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertGetCertificateChain CertOpenStore

comctl32

RemoveWindowSubclass SetWindowSubclass DefSubclassProc

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

combase

CoTaskMemFree CoTaskMemAlloc

shlwapi

SHCreateMemStream

oleaut32

SysAllocString VariantClear SysStringLen SysFreeString SetErrorInfo GetErrorInfo

secur32

FreeContextBuffer LsaGetLogonSessionData QueryContextAttributesW FreeCredentialsHandle AcceptSecurityContext AcquireCredentialsHandleA LsaFreeReturnBuffer InitializeSecurityContextW ApplyControlToken DeleteSecurityContext DecryptMessage EncryptMessage LsaEnumerateLogonSessions

bcrypt

BCryptGenRandom

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW

psapi

GetModuleFileNameExW GetProcessMemoryInfo EmptyWorkingSet GetPerformanceInfo

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryW PdhRemoveCounter PdhOpenQueryA

powrprof

CallNtPowerInformation

netapi32

NetUserEnum NetApiBufferFree NetUserGetInfo NetUserGetLocalGroups

iphlpapi

GetIfEntry2 GetIfTable2 FreeMibTable GetAdaptersAddresses

Name

.text

Size

12.4MB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

669KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_a41cddacd9c6fde28453a46dd99cd281_cobalt-strike_glassworm_icedid_njrat_satacom

rstrtmgr

advapi32

ntdll

bcryptprimitives

kernel32

ws2_32

shell32

ole32

user32

version

crypt32

comctl32

api-ms-win-core-synch-l1-2-0

combase

shlwapi

oleaut32

secur32

bcrypt

dwmapi

setupapi

psapi

gdi32

pdh

powrprof

netapi32

iphlpapi

generic