2026-10-01_49ae785b9164574df3698f36e80e4017_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_49ae785b9164574df3698f36e80e4017_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 9.5MB
Sample261002-srce3stdjd
SHA256 79bc8d1bcf3fc3cea970065685958359cc72db0cbba7d533abf3d6a7548cfbf9
MD5 49ae785b9164574df3698f36e80e4017
SHA1 2c85e056547922cd3c30fa1c9c58027ee96284b3
SHA512 12f66c39cc189adc33ea7b66a6ff32cd2becb896279351d904174fee1193af45e9143cb85c743f7456c927d5f91df08acf8f1ea8f3ec1d34cfea86cd1f23b3f5
SSDEEP 98304:4bKox99SLDjB+7jZtkD3SWp59ZtXVPRf:wx9EjGjXkD3ZZpDf
TLSH
T1C1A6D0362781A9B8F9DD3833C4192E066F763B43D366B1DF2B9124375A9FF848D28914
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_49ae785b9164574df3698f36e80e4017_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-01_49ae785b9164574df3698f36e80e4017_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 9.5MB

2026-10-01_49ae785b9164574df3698f36e80e4017_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 449a2071bc6f1940e82ef7237024a8f5
SHA256 79bc8d1bcf3fc3cea970065685958359cc72db0cbba7d533abf3d6a7548cfbf9
MD5 49ae785b9164574df3698f36e80e4017
SHA1 2c85e056547922cd3c30fa1c9c58027ee96284b3
SHA512 12f66c39cc189adc33ea7b66a6ff32cd2becb896279351d904174fee1193af45e9143cb85c743f7456c927d5f91df08acf8f1ea8f3ec1d34cfea86cd1f23b3f5
SSDEEP 98304:4bKox99SLDjB+7jZtkD3SWp59ZtXVPRf:wx9EjGjXkD3ZZpDf
TLSH
T1C1A6D0362781A9B8F9DD3833C4192E066F763B43D366B1DF2B9124375A9FF848D28914
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

885216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\External Panel\Old UI\-mgui-loader-menu-main\examples\example_win32_directx11\Release\ABNORMAL RED OBB 55 2.38.89.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

OpenProcess CloseHandle GetCurrentProcessId GetModuleHandleW WriteProcessMemory RtlAddFunctionTable Sleep VirtualProtectEx VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx GetExitCodeProcess GetModuleFileNameA Process32First GetModuleFileNameW WaitForSingleObject CreateToolhelp32Snapshot GetLastError GetFileAttributesA Process32Next GetSystemInfo Beep LocalFree ExitProcess FlushInstructionCache CreateProcessA IsWow64Process VirtualQueryEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect ReadConsoleW GetConsoleMode UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetModuleHandleA IsProcessorFeaturePresent HeapSize FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetFileType GetStdHandle RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable TerminateProcess GetCurrentProcess QueryPerformanceCounter GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar FreeLibrary CreateFileW SetStdHandle SetEnvironmentVariableW GetProcAddress QueryPerformanceFrequency LoadLibraryA SetFilePointerEx GetLocaleInfoA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateProcessW InitOnceBeginInitialize InitOnceComplete WriteFile SetEndOfFile CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemTimePreciseAsFileTime GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId RaiseException GetLogicalProcessorInformationEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW OutputDebugStringW

user32

SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture DefWindowProcW DispatchMessageA GetWindowRect DestroyWindow SetWindowPos MessageBoxW CreateWindowExW CallNextHookEx GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetKeyNameTextA GetAsyncKeyState GetCursorInfo SetWindowLongA SetWindowsHookExA GetWindowLongA SetWindowDisplayAffinity MapVirtualKeyA MessageBoxA MoveWindow UnhookWindowsHookEx SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA PostQuitMessage UpdateWindow GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges RegCloseKey ConvertSidToStringSidA GetTokenInformation RegCreateKeyExW RegSetValueExW

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

ntdll

ZwReadVirtualMemory RtlPcToFileHeader

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

crypt32

CryptStringToBinaryA

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_49ae785b9164574df3698f36e80e4017_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_43

kernel32

user32

advapi32

d3dx11_43

imm32

dwmapi

ntdll

winhttp

crypt32

generic