2026-10-22_b801b72ab10df546ed472d473cd4ecd9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_b801b72ab10df546ed472d473cd4ecd9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 1.5MB
Sample261023-3bf4fagw7j
SHA256 4426777f0bcae80e13bb3965af5729edc774e40aa8c78723f9318719d84e9fdb
MD5 b801b72ab10df546ed472d473cd4ecd9
SHA1 546cfe47373de6455aae5bf8a95418159729152c
SHA512 1942292688aafc79a25c76b6b1dd9983cf31c94a0c29a95e23952be9a1fc0d5db8fc3b439c3636173be53851e292220af95ed7444cfa90207e48ca86108b8cfb
SSDEEP 12288:R6lFRwqyYMjYmRti1xk3o5m+/D4Ep5pttUphkPgYi400tqxz/yasN9tC/XEK:QyYLEgfyEp5ptWKg0oxz/y/N9w/X/
TLSH
T15B7538292E641DCCD466843ECB83869FE2B1BC1A1F714BD717A17BA76E320D01A7B351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_b801b72ab10df546ed472d473cd4ecd9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 1.5MB

2026-10-22_b801b72ab10df546ed472d473cd4ecd9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 94ef711801b576f2c67104475314fa6c
SHA256 4426777f0bcae80e13bb3965af5729edc774e40aa8c78723f9318719d84e9fdb
MD5 b801b72ab10df546ed472d473cd4ecd9
SHA1 546cfe47373de6455aae5bf8a95418159729152c
SHA512 1942292688aafc79a25c76b6b1dd9983cf31c94a0c29a95e23952be9a1fc0d5db8fc3b439c3636173be53851e292220af95ed7444cfa90207e48ca86108b8cfb
SSDEEP 12288:R6lFRwqyYMjYmRti1xk3o5m+/D4Ep5pttUphkPgYi400tqxz/yasN9tC/XEK:QyYLEgfyEp5ptWKg0oxz/y/N9w/X/
TLSH
T15B7538292E641DCCD466843ECB83869FE2B1BC1A1F714BD717A17BA76E320D01A7B351
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

0c:61:b3:63:b7:6a:21:8a:92:28:9d:91:bd:65:44:d6:7e:15:66:10:70:ec:b8:fa:52:53:ed:38:6b:c7:53:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jun 14, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:12:24:60:a1:f7:9e:85:5e:1d:a9:a8:af:ca:9e:b2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 15, 2026 - Jul 17, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

372288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\output\unity\unity\artifacts\UnityCrashHandler\Win_x64_VS2022_VB_MT_nondev_m_m\UnityCrashHandler64.pdb

user32

LookupIconIdFromDirectoryEx GetDlgItem SendDlgItemMessageA AdjustWindowRect GetWindowLongA OffsetRect DialogBoxParamA SetWindowTextW EndDialog SendMessageW UnionRect GetIconInfo SetWindowPos InflateRect CreateIconFromResourceEx LoadImageA SetForegroundWindow

kernel32

HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetModuleHandleExW MultiByteToWideChar GetLastError QueryPerformanceFrequency QueryPerformanceCounter ReadFile SizeofResource FindFirstFileW EnterCriticalSection GetCommandLineW FindNextFileW GetCurrentProcess WriteFile TerminateProcess EnumResourceNamesA LeaveCriticalSection InitializeCriticalSection SetErrorMode SetFilePointer SetEndOfFile FindResourceA FindClose WaitForSingleObject CreateFileW UnmapViewOfFile GetModuleHandleA GetExitCodeThread SetEvent TerminateThread LoadLibraryA LockResource DeleteFileW CloseHandle LoadLibraryW CreateThread LoadResource GetProcAddress CreateFileMappingA GetFileSize DeleteCriticalSection ReadProcessMemory GetCurrentProcessId CreateProcessW FreeLibrary CopyFileW WideCharToMultiByte CreateEventA MapViewOfFile LoadLibraryExW FlushFileBuffers GetStdHandle GetProcessId GetTempPathW WaitForMultipleObjectsEx GetFileAttributesW OpenProcess Sleep GetThreadId GetSystemTimeAsFileTime GetSystemTime CopyFileExW AllocConsole GetExitCodeProcess CreateDirectoryW GetFileSizeEx FindFirstFileExW TlsSetValue GetFullPathNameW RemoveDirectoryW SetFileTime GetModuleFileNameW HeapSize IsValidCodePage GetDiskFreeSpaceExW SetFilePointerEx MoveFileExW ReplaceFileW SystemTimeToFileTime GetModuleHandleW TlsGetValue GetTempFileNameW CreateEventW FormatMessageW LocalFree SetWaitableTimer GetCurrentThreadId ResumeThread GetCurrentThread WaitForSingleObjectEx SleepEx CreateWaitableTimerExW OpenThread GetModuleFileNameA HeapFree SetLastError RtlCaptureContext OutputDebugStringA RtlVirtualUnwind Thread32Next RtlLookupFunctionEntry Thread32First GetEnvironmentVariableA SuspendThread GetCurrentDirectoryA CreateToolhelp32Snapshot GetFileAttributesA HeapAlloc GetThreadContext VerSetConditionMask GetProcessHeap VerifyVersionInfoW TlsAlloc TlsFree IsDebuggerPresent AcquireSRWLockExclusive ExitProcess WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetConsoleMode GetConsoleOutputCP GetFileType SetStdHandle SetConsoleCtrlHandler GetStartupInfoW IsProcessorFeaturePresent GetACP GetOEMCP InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo CompareStringEx SetFileAttributesW HeapQueryInformation GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetFileAttributesExW RtlUnwind LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW TryAcquireSRWLockExclusive InitializeSListHead ReleaseSRWLockExclusive

dbghelp

SymLoadModuleEx SymRegisterFunctionEntryCallback64 MiniDumpWriteDump ImageDirectoryEntryToDataEx

shell32

SHCreateDirectoryExW CommandLineToArgvW SHFileOperationW SHGetKnownFolderPath

ole32

CoTaskMemFree CoCreateGuid CoInitializeEx

shlwapi

PathCanonicalizeW

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

HttpQueryInfoA HttpOpenRequestA InternetCrackUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA

gdi32

GetObjectA

bcrypt

BCryptDeriveKeyPBKDF2 BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_b801b72ab10df546ed472d473cd4ecd9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

user32

kernel32

dbghelp

shell32

ole32

shlwapi

psapi

advapi32

wininet

gdi32

bcrypt

api-ms-win-core-synch-l1-2-0

version

generic