2026-10-01_61ac4c64a9627744e530b6d7d5dd5cba_cobalt-strike_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_61ac4c64a9627744e530b6d7d5dd5cba_cobalt-strike_glassworm_icedid_njrat
Size 10.3MB
Sample261002-qqg8tsvfnd
SHA256 39d9c95dc073d4ea03ef49bc71a663ba9780cfd1233e781f8efed77de7dfc83c
MD5 61ac4c64a9627744e530b6d7d5dd5cba
SHA1 92e0938179e79a00335232e3c18691a8a6698a4e
SHA512 5d8f5a9cc3640ca4e98aa6f4d93878c874a92fb0fe53d76fa121d9e89e4195bdb3df26a512c561d4f304cbe635e503c1a1c22b7dabed9dff4446118b7266bae3
SSDEEP 98304:rmD6ZAiJiwlc02eRQCHyFXXiMf7jFx9Sfv:rwwE0fHyNNx0
TLSH
T128B67C21E2F80298F0F386B895B75A16D5737C294721CADF215C656E0F37AD48E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_61ac4c64a9627744e530b6d7d5dd5cba_cobalt-strike_glassworm_icedid_njrat

File Explorer

2026-10-01_61ac4c64a9627744e530b6d7d5dd5cba_cobalt-strike_glassworm_icedid_njrat

.exe 10.3MB

2026-10-01_61ac4c64a9627744e530b6d7d5dd5cba_cobalt-strike_glassworm_icedid_njrat

IMPHASH 6f3b671636fc2820ed53e1d0c86c17bc
SHA256 39d9c95dc073d4ea03ef49bc71a663ba9780cfd1233e781f8efed77de7dfc83c
MD5 61ac4c64a9627744e530b6d7d5dd5cba
SHA1 92e0938179e79a00335232e3c18691a8a6698a4e
SHA512 5d8f5a9cc3640ca4e98aa6f4d93878c874a92fb0fe53d76fa121d9e89e4195bdb3df26a512c561d4f304cbe635e503c1a1c22b7dabed9dff4446118b7266bae3
SSDEEP 98304:rmD6ZAiJiwlc02eRQCHyFXXiMf7jFx9Sfv:rwwE0fHyNNx0
TLSH
T128B67C21E2F80298F0F386B895B75A16D5737C294721CADF215C656E0F37AD48E39B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\essam\Downloads\fang external\Fang\Build\Instance.new.pdb

advapi32

OpenProcessToken GetTokenInformation EventRegister EventSetInformation EventWriteTransfer EventUnregister RegOpenKeyExW RegQueryValueExW RegCloseKey RegGetValueW GetSidSubAuthorityCount GetSidSubAuthority

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoCreateInstance CoCreateFreeThreadedMarshaler

winmm

mciSendStringA PlaySoundW timeBeginPeriod

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

gdi32

GetDeviceCaps DeleteObject CreateRectRgn CombineRgn CreateRoundRectRgn

dwmapi

DwmEnableBlurBehindWindow DwmIsCompositionEnabled DwmGetColorizationColor DwmSetWindowAttribute DwmExtendFrameIntoClientArea

user32

GetWindowTextW LoadCursorW FindWindowExW SetWindowLongW GetWindowLongW SetForegroundWindow SetFocus IsZoomed SetWindowPos CreateWindowExW RegisterClassExW DefWindowProcW SendMessageW DispatchMessageW GetMessageW GetWindowTextLengthW MonitorFromPoint GetKeyNameTextA SetWindowLongA MessageBoxA GetWindowRect UpdateWindow GetSystemMetrics IsIconic IsWindowVisible SetWindowDisplayAffinity SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExA MapVirtualKeyA EnumWindows CallWindowProcW GetMonitorInfoW IsWindow RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA PeekMessageA EnableWindow IsWindowEnabled SetWindowRgn GetWindowLongPtrW SetWindowLongPtrW EnumChildWindows GetClassNameW GetWindow GetAncestor MessageBoxW GetWindowThreadProcessId GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState DispatchMessageA TranslateMessage FindWindowA ClipCursor GetCapture SetCapture ShowCursor SendInput GetAsyncKeyState EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetProcessDPIAware MonitorFromWindow LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture

kernel32

SetFilePointerEx ReadConsoleW GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber GetCommandLineW DeleteFileW IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext DuplicateHandle TerminateProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader CreatePipe GetCommandLineA HeapSize SetEndOfFile SetConsoleCtrlHandler WriteConsoleW CreateEventW SetEvent GetUserDefaultLCID InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable WakeConditionVariable InitOnceComplete InitOnceBeginInitialize CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 CreateDirectoryExW DeviceIoControl AreFileApisANSI CreateFile2 SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindFirstFileExW GetCurrentDirectoryW SetCurrentDirectoryW SleepConditionVariableSRW TryAcquireSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetLogicalProcessorInformationEx GetExitCodeThread GetCurrentThreadId VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA MultiByteToWideChar GetLocaleInfoA GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte GetTickCount64 Sleep GetStdHandle CreateDirectoryA GetFileAttributesA GetTempPathA GetLastError GetTickCount LoadResource LockResource SizeofResource FindResourceA GetConsoleMode SetConsoleMode GetModuleFileNameA CreateFileW ReadFile CloseHandle GetLocalTime GetModuleFileNameW GetModuleHandleW GetTimeZoneInformation GetGeoInfoW GetUserGeoID GetLocaleInfoEx GetEnvironmentVariableA CreateFileA FormatMessageA VirtualFreeEx GetFileAttributesW GetCurrentProcessId ExitProcess GetWindowsDirectoryA LoadLibraryW OpenProcess QueryFullProcessImageNameW SetLastError MulDiv GetEnvironmentVariableW CompareFileTime FindClose FindFirstFileW FindNextFileW GetFileSizeEx CreateDirectoryW WriteFile GetTempPathW WaitForSingleObject GetExitCodeProcess CreateProcessW GetProcessId CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next QueryFullProcessImageNameA Process32FirstW Process32NextW FindFirstFileA FindNextFileA SetUnhandledExceptionFilter GetCurrentProcess GetCurrentThread SetConsoleTitleA OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryExW LocalAlloc LocalFree HeapAlloc HeapReAlloc MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemTimePreciseAsFileTime WaitForSingleObjectEx SwitchToThread

shell32

SHGetKnownFolderPath ShellExecuteW ShellExecuteA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

msacm32

acmStreamOpen acmStreamClose acmStreamSize acmStreamConvert acmStreamUnprepareHeader acmStreamPrepareHeader

bcrypt

BCryptDestroyHash BCryptCreateHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGetProperty

comdlg32

GetOpenFileNameW

iphlpapi

GetAdaptersAddresses

urlmon

URLDownloadToFileA

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

391KB

Virtual Size

469KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

1024B

Virtual Size

809B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_61ac4c64a9627744e530b6d7d5dd5cba_cobalt-strike_glassworm_icedid_njrat

advapi32

d3d11

d3dcompiler_47

ole32

winmm

winhttp

gdi32

dwmapi

user32

kernel32

shell32

imm32

msacm32

bcrypt

comdlg32

iphlpapi

urlmon

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic