2026-10-23_368c481becc6050022accec317ba94e9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_368c481becc6050022accec317ba94e9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
Size 4.2MB
Sample261023-qqwffsch98
SHA256 0c788617a7ea2082e8b8691d8506a44891cda6a999e9bf4fbc4af4c4173b1517
MD5 368c481becc6050022accec317ba94e9
SHA1 8c3c90e7ac3d13b2ca85209c65f64cd090272ac4
SHA512 6e9ecd4154093ffecb4fd71078c17acd47e163a2678c03fc3d229013d35fe03393287ced52cc7b21cc37a1c208d4bbca2d31744d514e16c4e4e28d3474186501
SSDEEP 49152:weXsZCf0F/XOTrqL4dgUvMB7qrgRN3PJ009LtX8TW5pbimutj7bBftpd6yqynBvD:wez0FruMhqrg/bJX8f1/nqxpAYk
TLSH
T113165B13F1D641E8C01AD1794746A232B661BC4A4B34B2DB779CAB121F76FE0AB7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_368c481becc6050022accec317ba94e9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

File Explorer

2026-10-23_368c481becc6050022accec317ba94e9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

.exe 4.2MB

2026-10-23_368c481becc6050022accec317ba94e9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

IMPHASH 7537ade10bf017d695ad648a4ff83a23
SHA256 0c788617a7ea2082e8b8691d8506a44891cda6a999e9bf4fbc4af4c4173b1517
MD5 368c481becc6050022accec317ba94e9
SHA1 8c3c90e7ac3d13b2ca85209c65f64cd090272ac4
SHA512 6e9ecd4154093ffecb4fd71078c17acd47e163a2678c03fc3d229013d35fe03393287ced52cc7b21cc37a1c208d4bbca2d31744d514e16c4e4e28d3474186501
SSDEEP 49152:weXsZCf0F/XOTrqL4dgUvMB7qrgRN3PJ009LtX8TW5pbimutj7bBftpd6yqynBvD:wez0FruMhqrg/bJX8f1/nqxpAYk
TLSH
T113165B13F1D641E8C01AD1794746A232B661BC4A4B34B2DB779CAB121F76FE0AB7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2723888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

protoc.exe.pdb

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

dbghelp

SymFromAddr

shell32

CommandLineToArgvW

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateDirectoryW CreateFileW CreatePipe CreateProcessW DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OutputDebugStringA PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

626KB

Virtual Size

625KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

173KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

389B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

protodes

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_368c481becc6050022accec317ba94e9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

advapi32

dbghelp

shell32

kernel32

generic