2026-10-21_90a9020345219ec6ef21c1c8a81d4a8f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_90a9020345219ec6ef21c1c8a81d4a8f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.9MB
Sample261022-vy2dwsdz81
SHA256 f8b1ab4ea180694a05ec28dd79ea29a2c8e9ffc8b10ed6c430c1dfefece3a5f6
MD5 90a9020345219ec6ef21c1c8a81d4a8f
SHA1 8d6771228ecbcac74d2b748fcac158c965904f3f
SHA512 8566a5826cb7d8b2ecf75c32de5e91e627d8055679bc4dc9e8fc727b9a193df6ad526b9255ccc2204e1c6a756078a713cce566be049c8a061a8d097778f676f5
SSDEEP 49152:QjLvd6BnI/PmpRqEiZNJ7Glt9xJ9q0LDnQ:Q/dSImpRBX1Q
TLSH
T189E5294AEA7941E1C0BAD07CC683652BFC7134A68331A7D766859B172F237E4E93DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_90a9020345219ec6ef21c1c8a81d4a8f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-21_90a9020345219ec6ef21c1c8a81d4a8f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.9MB

2026-10-21_90a9020345219ec6ef21c1c8a81d4a8f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH a3f90b9cfb2514d328db28698cb0f066
SHA256 f8b1ab4ea180694a05ec28dd79ea29a2c8e9ffc8b10ed6c430c1dfefece3a5f6
MD5 90a9020345219ec6ef21c1c8a81d4a8f
SHA1 8d6771228ecbcac74d2b748fcac158c965904f3f
SHA512 8566a5826cb7d8b2ecf75c32de5e91e627d8055679bc4dc9e8fc727b9a193df6ad526b9255ccc2204e1c6a756078a713cce566be049c8a061a8d097778f676f5
SSDEEP 49152:QjLvd6BnI/PmpRqEiZNJ7Glt9xJ9q0LDnQ:Q/dSImpRBX1Q
TLSH
T189E5294AEA7941E1C0BAD07CC683652BFC7134A68331A7D766859B172F237E4E93DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1361632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileAttributesA TerminateProcess CreateProcessA OpenProcess GetEnvironmentVariableA GetTempPathA GetCurrentProcessId ExitProcess GetModuleFileNameW QueryFullProcessImageNameA GetComputerNameW DecodePointer HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx Process32First Process32Next MultiByteToWideChar Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateWaitableTimerA SetWaitableTimer CreateEventW SleepEx InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateIoCompletionPort SetLastError WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetModuleFileNameA TerminateThread QueueUserAPC SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect WaitForMultipleObjects CreateEventA CreateMutexA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus GetLastError CloseHandle UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RaiseException WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EncodePointer LCMapStringEx GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetCurrentProcess InitializeCriticalSection ResumeThread GetSystemInfo VirtualAllocEx VirtualFreeEx CreateActCtxW WriteFile CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetWindowsDirectoryW GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First ReadFile CreateNamedPipeW CreateThread GetProcessId IsWow64Process WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx LoadLibraryW FreeLibrary SuspendThread GetThreadTimes OpenThread IsDebuggerPresent OutputDebugStringW RtlLookupFunctionEntry RtlUnwindEx RtlUnwind

user32

wsprintfW

advapi32

RegOpenKeyExA AdjustTokenPrivileges OpenProcessToken RegCloseKey RegDeleteValueA RegNotifyChangeKeyValue RegQueryValueExA RegSetValueExA RegCreateKeyExA RegOpenKeyExW OpenThreadToken RegEnumValueW RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyW RegSetValueExW RegQueryValueExW LookupPrivilegeValueW

shell32

ShellExecuteA

ws2_32

ioctlsocket getsockopt connect closesocket WSACleanup select WSAStringToAddressW WSAStartup listen htons htonl bind accept freeaddrinfo getaddrinfo WSASocketW WSASend WSARecv WSAGetLastError WSASetLastError shutdown setsockopt ntohl

bcrypt

BCryptCloseAlgorithmProvider BCryptEncrypt BCryptImportKeyPair BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptGenRandom BCryptFinishHash

wininet

InternetSetOptionA

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty CertAddCertificateContextToStore PFXImportCertStore CertDeleteCertificateFromStore CryptUnprotectData

winhttp

WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpConnect WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse

ole32

CoCreateInstance CoUninitialize CoInitialize

shlwapi

SHDeleteKeyW

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_90a9020345219ec6ef21c1c8a81d4a8f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

wininet

crypt32

winhttp

ole32

shlwapi

oleaut32

generic