General
- Target 2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 2.0MB
- Sample261003-lyqsqawcmd
- SHA256 2094fa682875218c3c083ee6311ef0420c0fc54df5b1829eeb6bcc78c0088205
- MD5 7751085cc8713f17513073c8b7e9c2cb
- SHA1 f5d33a79c9cfcec06f9db7670cd06e9f88c505fc
- SHA512 9893a1001a3dd4afd6f5ee954b3049fcc11fc35031f96efc9aa05ded4c91547ea5c149475d2409bbbc281a347acabd6fed8792390e8aba28913369482038985f
- SSDEEP 49152:rv0g5A3Yj+Fq6EacQ1Ed6SG1Fy6qFKKcP7YOLUMXvInAJpqUR:IDUT36SG1FKFKKckOtXvIMpqUR
- TLSH T1B9A58E17A3B900EDD1A7C27DCA465907EB72B4050734ABDF13908A662F23AE15F7E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 2.0MB
- SHA256 2094fa682875218c3c083ee6311ef0420c0fc54df5b1829eeb6bcc78c0088205
- MD5 7751085cc8713f17513073c8b7e9c2cb
- SHA1 f5d33a79c9cfcec06f9db7670cd06e9f88c505fc
- SHA512 9893a1001a3dd4afd6f5ee954b3049fcc11fc35031f96efc9aa05ded4c91547ea5c149475d2409bbbc281a347acabd6fed8792390e8aba28913369482038985f
- SSDEEP 49152:rv0g5A3Yj+Fq6EacQ1Ed6SG1Fy6qFKKcP7YOLUMXvInAJpqUR:IDUT36SG1FKFKKckOtXvIMpqUR
- TLSH T1B9A58E17A3B900EDD1A7C27DCA465907EB72B4050734ABDF13908A662F23AE15F7E724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1