Extracted

• • Target
    2026-10-07_4c5a760e6b6243c1fed9f0f39c5d365d_cobalt-strike_glassworm_icedid_satacom
  • Size 10.3MB
  • SHA256 8244876cf511dcaaf67176b90887c8ecdd8c0530915c6f9f473000e94fdf78c2
  • MD5 4c5a760e6b6243c1fed9f0f39c5d365d
  • SHA1 5f12c4f995f1b785f42dfc1b205701489c0d940e
  • SHA512 896ff470b150371e6ab9c114f159893d809c08e5c06138519dc52a6035098de13b9d203f304601dda0e414460b8e5e742326e3854086d27000107b77223f8a48
  • SSDEEP 98304:3e3aEnGBprKHJajNyrtyh9rSIV26892O1UWqZ7nWsYLljHOg:3e3auGKHJajNgohV6f2O1UWqZ7nWxjl
  • TLSH
    T19EB69E05E3D049E0E666D638CE76C732D6B9BC815A31D30F155DF6CA1F33A908F6A628
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  defense_evasiondiscoveryexecutionspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2