General
- Target 2026-10-21_974d673502dfca722b2cff5582ce1fca_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.6MB
- Sample261022-tw6edsstct
- SHA256 30da4682092643274e34b2ca4f50ead042fd0cc07210c82357323534b44144d6
- MD5 974d673502dfca722b2cff5582ce1fca
- SHA1 1fa5fafd64397fc923ff2a360ea9b1c380a97749
- SHA512 9e8614aaf5c02bc5d4d36fd31b21e7dacf557cea3dfcc3a071ca7584234408af4828261bb94f95e2bd0fc35cf6bfb6f343003343eb1bc729a7efbb8bc6d45092
- SSDEEP 98304:IyDFX91baG66yEnPweoUcrGWOWRApzNE79N5SSDntdDpbRZy:Iyh7+vAWRsz8ZSintdDFRo
- TLSH T1B7968D13F2A501E8D05ED574CF3A56329A357C4A4BB0A3EF29D436A11A75ED4BB3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_974d673502dfca722b2cff5582ce1fca_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
23 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-21_974d673502dfca722b2cff5582ce1fca_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.6MB
- SHA256 30da4682092643274e34b2ca4f50ead042fd0cc07210c82357323534b44144d6
- MD5 974d673502dfca722b2cff5582ce1fca
- SHA1 1fa5fafd64397fc923ff2a360ea9b1c380a97749
- SHA512 9e8614aaf5c02bc5d4d36fd31b21e7dacf557cea3dfcc3a071ca7584234408af4828261bb94f95e2bd0fc35cf6bfb6f343003343eb1bc729a7efbb8bc6d45092
- SSDEEP 98304:IyDFX91baG66yEnPweoUcrGWOWRApzNE79N5SSDntdDpbRZy:Iyh7+vAWRsz8ZSintdDFRo
- TLSH T1B7968D13F2A501E8D05ED574CF3A56329A357C4A4BB0A3EF29D436A11A75ED4BB3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1