2026-10-02_2716521176e76ad750443f0c560b8aa0_cobalt-strike_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_2716521176e76ad750443f0c560b8aa0_cobalt-strike_glassworm_icedid_njrat_stealc
Size 8.3MB
Sample261003-s5kzdatvaz
SHA256 f5128591319d1618387c4bfcf839b9d0201063e1c90e5598b547793234830337
MD5 2716521176e76ad750443f0c560b8aa0
SHA1 5c4e8c01e0110de563ec1a85a7cfcd41205b0ab4
SHA512 d9e8c9b98d7787ee7f3b7eed895a2f3e6f42ffac36e3d7c5ce76d7b85cea7b7d58491f756af46c1c4178190bb2ceafa954fbae3a2b8db097738c02f5fd50d43c
SSDEEP 49152:NRdTF6pXc+otTmefHtM4N5rcSF0GbN/nn5CxKTdoZoVCBtMeX8WmJdQpl3S4y2Ru:yNCSs5CxKTd0o8Bt3Cc+1WQsS
TLSH
T12B964CCBB6E11892CA93CD78595C57CBFA52354C071C06F706E48ED32AA3ADA1F35236
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_2716521176e76ad750443f0c560b8aa0_cobalt-strike_glassworm_icedid_njrat_stealc

File Explorer

2026-10-02_2716521176e76ad750443f0c560b8aa0_cobalt-strike_glassworm_icedid_njrat_stealc

.exe 8.3MB

2026-10-02_2716521176e76ad750443f0c560b8aa0_cobalt-strike_glassworm_icedid_njrat_stealc

IMPHASH e82686267d243e531b2f372e2531d273
SHA256 f5128591319d1618387c4bfcf839b9d0201063e1c90e5598b547793234830337
MD5 2716521176e76ad750443f0c560b8aa0
SHA1 5c4e8c01e0110de563ec1a85a7cfcd41205b0ab4
SHA512 d9e8c9b98d7787ee7f3b7eed895a2f3e6f42ffac36e3d7c5ce76d7b85cea7b7d58491f756af46c1c4178190bb2ceafa954fbae3a2b8db097738c02f5fd50d43c
SSDEEP 49152:NRdTF6pXc+otTmefHtM4N5rcSF0GbN/nn5CxKTdoZoVCBtMeX8WmJdQpl3S4y2Ru:yNCSs5CxKTd0o8Bt3Cc+1WQsS
TLSH
T12B964CCBB6E11892CA93CD78595C57CBFA52354C071C06F706E48ED32AA3ADA1F35236
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntdll

RtlVirtualUnwind RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext NtUnloadDriver NtLoadDriver RtlInitUnicodeString RtlAdjustPrivilege NtQuerySystemInformation RtlUnwind

advapi32

RegDeleteTreeW RegSetKeyValueW RegOpenKeyW RegCreateKeyW RegCloseKey RegGetValueW

winhttp

WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpCrackUrl WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

kernel32

SetStdHandle GetProcessHeap HeapSize SetEndOfFile FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage CreateFileA CloseHandle DuplicateHandle WaitForSingleObject GetCurrentProcess GetExitCodeProcess OpenProcess VirtualQuery GetModuleHandleA GetProcAddress GetCommandLineW FlushFileBuffers ReadFile WriteFile GetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW LoadResource LockResource SizeofResource FindResourceW LocalFree MultiByteToWideChar WideCharToMultiByte DeviceIoControl CreateFileW GetCurrentProcessId GetCurrentThreadId VirtualAlloc VirtualFree GetTempPathW GetModuleFileNameW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType QueryPerformanceCounter QueryPerformanceFrequency Sleep ReleaseSRWLockExclusive HeapAlloc AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW DeleteFileW IsProcessorFeaturePresent GetStdHandle ExitProcess TerminateProcess IsDebuggerPresent UnhandledExceptionFilter HeapFree WriteConsoleW

shell32

CommandLineToArgvW

Name

.text

Size

236KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rtdat

Size

512KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rtcod

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ehs

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ehx

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rtreloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_2716521176e76ad750443f0c560b8aa0_cobalt-strike_glassworm_icedid_njrat_stealc

ntdll

advapi32

winhttp

kernel32

shell32

generic