2026-10-16_9e67aa9b8ce4cc359b630a87a4efc501_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_9e67aa9b8ce4cc359b630a87a4efc501_cobalt-strike_glassworm_icedid_satacom_stealc_vidar
Size 2.7MB
Sample261017-mwp9vaes3s
SHA256 2ed717c4cd6164b68eddfbb818e58c52de3780b29e6781016eb6321337d12d1e
MD5 9e67aa9b8ce4cc359b630a87a4efc501
SHA1 06db5b80d93489de0fa17a343a07e8708668dc49
SHA512 0a1774240cfd8c76c309a03454b9ad00630022283eeea7da59c35dea83ca6e3225b15456110a608d1c292fdf2d2eec5540174fe436f73db4feffdaf9bb9e4060
SSDEEP 49152:cAQ3L+JfezynVxz6eGYe7gLzzmglP8JeuOWAaAd21aUVHb2TPxWPn8JfezynVxzm:pZ+ynVxz6eGYv/Iwd21aUZb2TPxVZ+y9
TLSH
T163D5E046B2E944E9C0ABD078CA575617EAB2345417309BDF13E0866D2F63BE0AF3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_9e67aa9b8ce4cc359b630a87a4efc501_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

File Explorer

2026-10-16_9e67aa9b8ce4cc359b630a87a4efc501_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

.exe 2.7MB

2026-10-16_9e67aa9b8ce4cc359b630a87a4efc501_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

IMPHASH dafac336db38848704dfa5141d493572
SHA256 2ed717c4cd6164b68eddfbb818e58c52de3780b29e6781016eb6321337d12d1e
MD5 9e67aa9b8ce4cc359b630a87a4efc501
SHA1 06db5b80d93489de0fa17a343a07e8708668dc49
SHA512 0a1774240cfd8c76c309a03454b9ad00630022283eeea7da59c35dea83ca6e3225b15456110a608d1c292fdf2d2eec5540174fe436f73db4feffdaf9bb9e4060
SSDEEP 49152:cAQ3L+JfezynVxz6eGYe7gLzzmglP8JeuOWAaAd21aUVHb2TPxWPn8JfezynVxzm:pZ+ynVxz6eGYv/Iwd21aUZb2TPxVZ+y9
TLSH
T163D5E046B2E944E9C0ABD078CA575617EAB2345417309BDF13E0866D2F63BE0AF3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW GetMessageW ShowWindow SetTimer KillTimer EnableWindow GetSystemMetrics DrawTextW BeginPaint TranslateMessage CreateWindowExW EndPaint LoadCursorW FindWindowW GetParent GetWindowLongPtrW FillRect ScreenToClient SetCursor MessageBoxW GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW GetPropW SetPropW InvalidateRect SetWindowRgn TrackMouseEvent

gdi32

SetTextColor SetBkMode SetBkColor SelectObject RoundRect GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

shell32

ShellExecuteExW

ole32

CreateStreamOnHGlobal

gdiplus

GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipLoadImageFromStream GdipDrawImageRectI GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics

comctl32

ord413 ord410 InitCommonControlsEx

kernel32

ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree ExitProcess GetModuleFileNameW GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW HeapSize WriteConsoleW SetEndOfFile AcquireSRWLockExclusive CreateFileW DeleteFileW WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetProcessHeap HeapLock Sleep GetCurrentProcess TerminateProcess SetPriorityClass VirtualProtect GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive RtlUnwind TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetSystemTimeAsFileTime GetProcAddress GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetStartupInfoW FreeLibrary RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

Name

.text

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

686KB

Virtual Size

692KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_9e67aa9b8ce4cc359b630a87a4efc501_cobalt-strike_glassworm_icedid_satacom_stealc_vidar

user32

gdi32

shell32

ole32

gdiplus

comctl32

kernel32

generic