2026-10-01_2d5c0d11905fec0f9af7c31f8d85a70b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_2d5c0d11905fec0f9af7c31f8d85a70b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 4.7MB
Sample261002-v3d46afb97
SHA256 4fe2c8ca53ac004473b5d605c3502d681cb634eded2d80e6eb6d87508d2d9bd8
MD5 2d5c0d11905fec0f9af7c31f8d85a70b
SHA1 f583747bf2a9d8e48af903f63dfb1f3e00ec382d
SHA512 343489c95627213654db8202d642e813021c6f3be4668383840f38c8b4871389f5e3e319c63227ee366a6fc40df8b206f618ace02474a7a0e9cfb01fa32729c6
SSDEEP 98304:Fk7D+QfjHB5c/hp0ChiTooFEBADRicp2plZ6:Fk7Hh5cjjaooFRJA8
TLSH
T13636BE07E3A242E8C626D47CC6568313F3717C091720A6DB6BE40F965F57AE06EBB790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_2d5c0d11905fec0f9af7c31f8d85a70b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-01_2d5c0d11905fec0f9af7c31f8d85a70b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 4.7MB

2026-10-01_2d5c0d11905fec0f9af7c31f8d85a70b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 259b713ae27706407386b76436d74a96
SHA256 4fe2c8ca53ac004473b5d605c3502d681cb634eded2d80e6eb6d87508d2d9bd8
MD5 2d5c0d11905fec0f9af7c31f8d85a70b
SHA1 f583747bf2a9d8e48af903f63dfb1f3e00ec382d
SHA512 343489c95627213654db8202d642e813021c6f3be4668383840f38c8b4871389f5e3e319c63227ee366a6fc40df8b206f618ace02474a7a0e9cfb01fa32729c6
SSDEEP 98304:Fk7D+QfjHB5c/hp0ChiTooFEBADRicp2plZ6:Fk7Hh5cjjaooFRJA8
TLSH
T13636BE07E3A242E8C626D47CC6568313F3717C091720A6DB6BE40F965F57AE06EBB790
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1762656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\uwu\Desktop\bloom external src\x64\Release\bloomlauncher.pdb

d3dx9_43

D3DXVec3Transform D3DXVec3Normalize D3DXMatrixTranspose

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

InitializeSListHead CreateFileMappingA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetSystemDirectoryA VerifyVersionInfoA MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SetLastError FormatMessageA CreateFileW VirtualAllocEx AddVectoredExceptionHandler HeapDestroy HeapSize CreateFileMappingW GetModuleFileNameA VirtualFreeEx GetModuleFileNameW QueryFullProcessImageNameW InitializeCriticalSection LocalFree GetSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive Module32Next SleepConditionVariableSRW GetCurrentThreadId HeapAlloc CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW ReadFile UnmapViewOfFile OutputDebugStringW SetUnhandledExceptionFilter GetCurrentThread GetLastError GetModuleHandleA SetThreadPriority GetCurrentProcess SetThreadAffinityMask GlobalUnlock CreateRemoteThread GetModuleHandleW ExitProcess GlobalLock GetProcAddress Process32FirstW GlobalAlloc LoadLibraryA K32GetProcessMemoryInfo Process32NextW Sleep WaitForSingleObject WriteProcessMemory ReadProcessMemory IsDebuggerPresent GetTickCount GetCurrentProcessId GetLocalTime CreateThread CreateFileA GlobalAddAtomA GetTempPathA GetStartupInfoW WriteFile WakeAllConditionVariable GetSystemTimeAsFileTime GetLocaleInfoEx GetFileInformationByHandleEx CloseHandle CreateToolhelp32Snapshot OpenProcess Module32First MapViewOfFile GetProcessHeap HeapFree GetFileSizeEx HeapReAlloc VirtualProtect QueryPerformanceCounter FreeLibrary VerSetConditionMask MultiByteToWideChar QueryPerformanceFrequency GetLocaleInfoA WideCharToMultiByte GlobalFree GetCurrentDirectoryW AreFileApisANSI CreateFile2 SetFileInformationByHandle VirtualProtectEx

user32

SetClipboardData GetClipboardData TranslateMessage SetLayeredWindowAttributes MapVirtualKeyA SetWindowDisplayAffinity PeekMessageW EmptyClipboard CloseClipboard GetMonitorInfoW DispatchMessageW OpenClipboard GetKeyNameTextA ShowWindow RegisterClassExW CreateWindowExW GetClientRect MonitorFromWindow DestroyWindow LoadCursorA DefWindowProcW GetAsyncKeyState FindWindowA PostQuitMessage GetWindowLongPtrA PeekMessageA DefWindowProcA MoveWindow MessageBoxA SetWindowLongA UnregisterClassW SetWindowPos GetWindowRect DispatchMessageA EnumDisplayMonitors mouse_event GetForegroundWindow GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetCursor SetCapture GetCapture UpdateWindow ClientToScreen TrackMouseEvent GetWindowLongA LoadIconA GetKeyState GetMessageExtraInfo ScreenToClient GetKeyboardLayout GetSystemMetrics

gdi32

GetStockObject

advapi32

CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptDestroyHash CryptHashData CryptCreateHash CryptImportKey CryptEncrypt AddAccessAllowedAce GetLengthSid InitializeAcl IsValidSid SetSecurityInfo CopySid ConvertSidToStringSidA SystemFunction036 CryptDestroyKey RegCloseKey RegDeleteKeyA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegGetValueA AdjustTokenPrivileges OpenProcessToken GetTokenInformation

shell32

ShellExecuteA

msvcp140

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Thrd_detach _Xtime_get_ticks ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z __crtLCMapStringW ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpCrackUrl WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryDataAvailable

ws2_32

listen ioctlsocket accept ntohl WSACleanup select getaddrinfo recvfrom htonl WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError send recv closesocket gethostname __WSAFDIsSet sendto freeaddrinfo

normaliz

IdnToAscii

crypt32

CertFindExtension CertGetNameStringA CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject

wldap32

ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord217 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord26 ord143

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

winmm

timeBeginPeriod

dwmapi

DwmUpdateThumbnailProperties DwmRegisterThumbnail DwmExtendFrameIntoClientArea DwmUnregisterThumbnail

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context __intrinsic_setjmp memmove memcpy longjmp strrchr __RTtypeid memcmp __std_type_info_compare strchr strstr __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memchr memset

api-ms-win-crt-heap-l1-1-0

malloc calloc free realloc _set_new_mode _callnewh

api-ms-win-crt-string-l1-1-0

toupper _wcsicmp strncpy_s strcat_s strcmp strncmp wcslen strpbrk strcspn strspn isupper tolower _strdup strlen strncpy

api-ms-win-crt-stdio-l1-1-0

fsetpos fgetpos __stdio_common_vsscanf __stdio_common_vsprintf fwrite _fseeki64 __p__commode _get_stream_buffer_pointers __stdio_common_vfprintf __stdio_common_vsprintf_s _wfopen _write _close fflush _set_fmode _open __acrt_iob_func fputc __stdio_common_vsnprintf_s _popen _read fopen fputs fgets _lseeki64 fread feof ungetc _pclose fgetc fseek setvbuf fclose ftell

api-ms-win-crt-runtime-l1-1-0

__sys_nerr system _invalid_parameter_noinfo_noreturn _getpid _crt_atexit _initterm _beginthreadex _get_narrow_winmain_command_line strerror _register_onexit_function terminate abort _cexit _errno _initterm_e _initialize_narrow_environment _configure_narrow_argv exit _exit _invalid_parameter_noinfo _c_exit _register_thread_local_exe_atexit_callback _resetstkoflw _set_app_type _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-convert-l1-1-0

strtoul strtod strtoll atoi strtol strtoull mbstowcs

api-ms-win-crt-math-l1-1-0

cosf sqrtf acosf _hypotf __setusermatherr sinf fmodf _dsign ceilf powf

api-ms-win-crt-time-l1-1-0

_time64 _localtime64 _gmtime64 strftime _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _fstat64 _lock_file _stat64 _access _unlink

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv ___lc_locale_name_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_2d5c0d11905fec0f9af7c31f8d85a70b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3dx9_43

d3dx11_43

d3d11

kernel32

user32

gdi32

advapi32

shell32

msvcp140

winhttp

ws2_32

normaliz

crypt32

wldap32

ntdll

winmm

dwmapi

imm32

d3dcompiler_47

shlwapi

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic