2026-10-01_7a94e84bad10d12d64ccd5ea9301142b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_7a94e84bad10d12d64ccd5ea9301142b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 3.0MB
Sample261002-m8tsssybpg
SHA256 eafbfc74c2deda45957c94faa49b8a957a3925c27c38121ea4934a8b9f1350d9
MD5 7a94e84bad10d12d64ccd5ea9301142b
SHA1 f243199c8bd57676c1723dbd2a79fdcefcf29dac
SHA512 5b781d9410b74e1f7b22fdfb63d9a30022a236540c2c4e12b89e6009f0e53122df137fa6db9ebe9740f905a92760a72c7f0191409bd8a2ffff86f0c57960528f
SSDEEP 49152:Dq98eH6pKYMfeeSkvPCHVJ8qn6+ypvqRwAU7U5WpxJAxCLXezekh/aHnS:G6pKYMFFSHzngEw6
TLSH
T1A7E5AF67A2A500FCD0B7E0B4DE5A6903E632384903316BEF13D499652F376E45A7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_7a94e84bad10d12d64ccd5ea9301142b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-01_7a94e84bad10d12d64ccd5ea9301142b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 3.0MB

2026-10-01_7a94e84bad10d12d64ccd5ea9301142b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 09c52722a38d87a3abb25fecba76833b
SHA256 eafbfc74c2deda45957c94faa49b8a957a3925c27c38121ea4934a8b9f1350d9
MD5 7a94e84bad10d12d64ccd5ea9301142b
SHA1 f243199c8bd57676c1723dbd2a79fdcefcf29dac
SHA512 5b781d9410b74e1f7b22fdfb63d9a30022a236540c2c4e12b89e6009f0e53122df137fa6db9ebe9740f905a92760a72c7f0191409bd8a2ffff86f0c57960528f
SSDEEP 49152:Dq98eH6pKYMfeeSkvPCHVJ8qn6+ypvqRwAU7U5WpxJAxCLXezekh/aHnS:G6pKYMFFSHzngEw6
TLSH
T1A7E5AF67A2A500FCD0B7E0B4DE5A6903E632384903316BEF13D499652F376E45A7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2001840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d12

ord102 D3D12SerializeRootSignature ord101

d3d11

D3D11On12CreateDevice D3D11CreateDevice

dxgi

CreateDXGIFactory1 CreateDXGIFactory2

d3dcompiler_47

D3DCompile

windowscodecs

WICConvertBitmapSource

ole32

CoInitializeEx CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal GetHGlobalFromStream PropVariantClear CoUninitialize

shell32

DragAcceptFiles ShellExecuteW SHCreateItemFromParsingName DragFinish ShellExecuteExW DragQueryFileW SHGetKnownFolderPath CommandLineToArgvW

shlwapi

ord12

user32

PeekMessageW RegisterHotKey UnregisterHotKey PostMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetWindowPos GetWindowPlacement SetWindowPlacement MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx SetTimer KillTimer UpdateWindow SetForegroundWindow GetDC ReleaseDC GetClientRect AdjustWindowRect GetWindowLongPtrW SetWindowLongPtrW LoadCursorW LoadIconW SystemParametersInfoW MonitorFromRect DispatchMessageW EnumDisplaySettingsW TranslateMessage SetProcessDPIAware ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState MonitorFromWindow TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard AdjustWindowRectEx IsZoomed IsIconic FindWindowW EnumDisplayDevicesA EnumDisplaySettingsA GetDpiForSystem MessageBoxA MessageBoxW GetWindowThreadProcessId DrawIconEx LoadImageW DestroyIcon DrawTextW UpdateLayeredWindow RegisterClassW GetMessageW ChangeWindowMessageFilterEx GetMonitorInfoW GetMessageExtraInfo

gdi32

GdiFlush CreateDIBSection SetTextColor SetBkMode SelectObject RoundRect DeleteObject DeleteDC CreatePen CreateFontW CreateCompatibleDC GetDeviceCaps CreateSolidBrush

dwmapi

DwmSetWindowAttribute

advapi32

RegQueryValueExW RegOpenKeyExW RegGetValueA RegQueryValueExA RegOpenKeyExA RegCloseKey RegGetValueW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeEndPeriod timeBeginPeriod

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest

ws2_32

accept bind closesocket connect htonl htons listen select send setsockopt shutdown socket gethostname WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo inet_ntop recv

kernel32

RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc RtlLookupFunctionEntry RtlUnwindEx InitializeSListHead GetStartupInfoW GetCPInfo GetStringTypeW LCMapStringEx DecodePointer UnhandledExceptionFilter InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread RaiseException RtlPcToFileHeader IsDebuggerPresent IsProcessorFeaturePresent ExitThread EncodePointer FreeLibraryAndExitThread SetThreadPriority HeapReAlloc WakeConditionVariable InitializeConditionVariable InitializeCriticalSectionEx WriteConsoleA VerifyVersionInfoW LocalAlloc GetFullPathNameW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateSemaphoreA ReleaseSemaphore OpenFileMappingA CreateFileMappingA CreateMutexA ReleaseMutex GetConsoleWindow SetConsoleTitleA SetConsoleTextAttribute AllocConsole OpenMutexA GetModuleFileNameA IsDBCSLeadByte GetLocaleInfoA VerSetConditionMask LoadLibraryA GetModuleHandleA GlobalFree GlobalAlloc ExitProcess HeapFree HeapAlloc GetFileType GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW IsValidCodePage GetACP SleepConditionVariableCS GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize SetEndOfFile WriteConsoleW WaitForSingleObjectEx RtlUnwind GetSystemTimeAsFileTime GetStdHandle UnmapViewOfFile MapViewOfFile CreateFileMappingW FreeLibrary VirtualProtect FlushInstructionCache SetLastError SetThreadDescription LoadLibraryExW GetTickCount64 LoadLibraryW GlobalLock GlobalUnlock GetUserDefaultUILanguage OutputDebugStringA MoveFileExW FormatMessageW GetSystemDirectoryW GetCurrentProcessId CreatePipe SetHandleInformation GetTempPathW SetFileAttributesW RemoveDirectoryW FindFirstFileW DeleteFileW GetTimeFormatW WideCharToMultiByte MultiByteToWideChar FormatMessageA QueryPerformanceFrequency QueryPerformanceCounter GetFileAttributesExW GetFileAttributesW CreateDirectoryW K32GetProcessMemoryInfo CopyFileW CreateProcessW GetCurrentThread GetExitCodeProcess GetCommandLineW CreateFileW WriteFile CloseHandle SetUnhandledExceptionFilter SetEvent WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess CreateThread GetCurrentThreadId TerminateThread GetLocalTime GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LocalFree SetEnvironmentVariableW FindClose FindFirstFileExW FindNextFileW GetFileSizeEx ReadFile SetFilePointerEx GetLastError Sleep

oleaut32

VariantInit

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

665KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_7a94e84bad10d12d64ccd5ea9301142b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3d12

d3d11

dxgi

d3dcompiler_47

windowscodecs

ole32

shell32

shlwapi

user32

gdi32

dwmapi

advapi32

version

winmm

winhttp

ws2_32

kernel32

oleaut32

imm32

generic