General
- Target 2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
- Size 5.4MB
- Sample261020-wpswtstsbz
- SHA256 9c4cb1e1fd5cc1d343ace6b626cb7277553e96b2dfa1b82a0dfbf1912ee4abee
- MD5 66847c8294c4d4456399ef7be28124c9
- SHA1 b0569ba8a7f13987995c025b241eda950cbaae08
- SHA512 d7b6388266d182580f4bdb17637f0ccdf2cc2c80ac8123dfb6ba591906c5c17e2b7c1d97694da72673bb737d5c7905927b3bdc11ab50a8453d47e99b7db3515c
- SSDEEP 49152:jSql2zlYvdmlQN6WRbQpUyDdCB3hAm1oQ2K0oTJMufn/OVp6I5hDDS4XYe4kOe4V:viam+bHAi07Ccpr5/dRlTJT0U023W
- TLSH T12646AE13F1DA11D8C01DD1B9874A9232EA61BC494B25B6DF0B9077522F7AEE4AF3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
- Size 5.4MB
- SHA256 9c4cb1e1fd5cc1d343ace6b626cb7277553e96b2dfa1b82a0dfbf1912ee4abee
- MD5 66847c8294c4d4456399ef7be28124c9
- SHA1 b0569ba8a7f13987995c025b241eda950cbaae08
- SHA512 d7b6388266d182580f4bdb17637f0ccdf2cc2c80ac8123dfb6ba591906c5c17e2b7c1d97694da72673bb737d5c7905927b3bdc11ab50a8453d47e99b7db3515c
- SSDEEP 49152:jSql2zlYvdmlQN6WRbQpUyDdCB3hAm1oQ2K0oTJMufn/OVp6I5hDDS4XYe4kOe4V:viam+bHAi07Ccpr5/dRlTJT0U023W
- TLSH T12646AE13F1DA11D8C01DD1B9874A9232EA61BC494B25B6DF0B9077522F7AEE4AF3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1