2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom
Size 2.0MB
Sample261003-lyqsqawcmd
SHA256 2094fa682875218c3c083ee6311ef0420c0fc54df5b1829eeb6bcc78c0088205
MD5 7751085cc8713f17513073c8b7e9c2cb
SHA1 f5d33a79c9cfcec06f9db7670cd06e9f88c505fc
SHA512 9893a1001a3dd4afd6f5ee954b3049fcc11fc35031f96efc9aa05ded4c91547ea5c149475d2409bbbc281a347acabd6fed8792390e8aba28913369482038985f
SSDEEP 49152:rv0g5A3Yj+Fq6EacQ1Ed6SG1Fy6qFKKcP7YOLUMXvInAJpqUR:IDUT36SG1FKFKKckOtXvIMpqUR
TLSH
T1B9A58E17A3B900EDD1A7C27DCA465907EB72B4050734ABDF13908A662F23AE15F7E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom

File Explorer

2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom

.exe 2.0MB

2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom

IMPHASH 0cbc734fe65514278085c6a10392b8ba
SHA256 2094fa682875218c3c083ee6311ef0420c0fc54df5b1829eeb6bcc78c0088205
MD5 7751085cc8713f17513073c8b7e9c2cb
SHA1 f5d33a79c9cfcec06f9db7670cd06e9f88c505fc
SHA512 9893a1001a3dd4afd6f5ee954b3049fcc11fc35031f96efc9aa05ded4c91547ea5c149475d2409bbbc281a347acabd6fed8792390e8aba28913369482038985f
SSDEEP 49152:rv0g5A3Yj+Fq6EacQ1Ed6SG1Fy6qFKKcP7YOLUMXvInAJpqUR:IDUT36SG1FKFKKckOtXvIMpqUR
TLSH
T1B9A58E17A3B900EDD1A7C27DCA465907EB72B4050734ABDF13908A662F23AE15F7E724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6c:1f:0c:09:de:c9:46:6b:18:27:19:46:b0:4a:54:01:7d:95:e3:37:5f:81:cc:f5:90:f3:a8:b6:7c:02:93:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation

Chains

Sep 30, 2026

CN=Microsoft Corporation

Subject

CN=Microsoft Corporation

Serial Number

58:48:4f:84:44:f1:15:bc:41:97:71:b9:e6:ab:aa:2c

Issuer

CN=Microsoft Corporation

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 30, 2026 - Sep 30, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1345408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider

ole32

CoTaskMemFree CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetKnownFolderPath

advapi32

RegGetValueW CheckTokenMembership FreeSid AllocateAndInitializeSid

ws2_32

WSAStartup htonl listen recv bind select closesocket htons send WSACleanup __WSAFDIsSet socket setsockopt accept

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

winhttp

WinHttpCrackUrl WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpOpen

gdi32

CreateCompatibleBitmap DeleteDC DeleteObject SelectObject BitBlt CreateCompatibleDC

user32

GetDC ReleaseDC GetSystemMetrics

gdiplus

GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize

kernel32

SetFilePointerEx GetConsoleMode GetConsoleOutputCP ReadConsoleW GetExitCodeProcess GetTimeZoneInformation IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetACP LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetDateFormatW RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetModuleHandleExW GetStdHandle GetFileType GetTempPathW Sleep GetCurrentProcessId GetEnvironmentVariableW GetFileSizeEx GetFinalPathNameByHandleW ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe CreateNamedPipeW WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess CreateRemoteThread GetCurrentThreadId CreateProcessW OpenProcess GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW LocalFree SetDllDirectoryW GetComputerNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualQueryEx ReadProcessMemory Process32First Process32Next FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetExitCodeThread GetLogicalProcessorInformationEx GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 CopyFile2 GetFileInformationByHandleEx RtlPcToFileHeader GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_7751085cc8713f17513073c8b7e9c2cb_cobalt-strike_glassworm_icedid_njrat_satacom

PE Signature issue

crypt32

bcrypt

ole32

shell32

advapi32

ws2_32

oleaut32

winhttp

gdi32

user32

gdiplus

kernel32

generic