2026-10-23_1602ec0da6dd4ed654e28ffb06b8b890_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_1602ec0da6dd4ed654e28ffb06b8b890_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar
Size 1.3MB
Sample261023-sbmacadb24
SHA256 5be35ef0ba9f020879f20c75ecf6ddb8466289eabf0f4a3e45b14953843e21a8
MD5 1602ec0da6dd4ed654e28ffb06b8b890
SHA1 42b12744b820039cdb64fe40b495c96ede53c8ac
SHA512 3f88ca7175faf6f27eda97db3640b684f201fe56f6281c069a28eedacf1d71a229dbc8ea0fa8852dff2fbb7a3ac00e2654ff678357b3db0e9c1b5b124ed53118
SSDEEP 24576:oAaUSCDOAC8+M2lntTrHjd+YsH2vi3oebp3szAzlgWulsONkp:oAL658V2lnt3Hjd+YsHX3np3suKsO
TLSH
T1BA55AF07F5A346E8C46AC138CA934133FB3174694B206ADB639892353F67BE04E7B759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_1602ec0da6dd4ed654e28ffb06b8b890_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

File Explorer

2026-10-23_1602ec0da6dd4ed654e28ffb06b8b890_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

.exe 1.3MB

2026-10-23_1602ec0da6dd4ed654e28ffb06b8b890_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

IMPHASH 66787f57a8b24acd274aa234aea5fbff
SHA256 5be35ef0ba9f020879f20c75ecf6ddb8466289eabf0f4a3e45b14953843e21a8
MD5 1602ec0da6dd4ed654e28ffb06b8b890
SHA1 42b12744b820039cdb64fe40b495c96ede53c8ac
SHA512 3f88ca7175faf6f27eda97db3640b684f201fe56f6281c069a28eedacf1d71a229dbc8ea0fa8852dff2fbb7a3ac00e2654ff678357b3db0e9c1b5b124ed53118
SSDEEP 24576:oAaUSCDOAC8+M2lntTrHjd+YsH2vi3oebp3szAzlgWulsONkp:oAL658V2lnt3Hjd+YsHX3np3suKsO
TLSH
T1BA55AF07F5A346E8C46AC138CA934133FB3174694B206ADB639892353F67BE04E7B759
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

brotli.exe.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

768KB

Virtual Size

767KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

535KB

Virtual Size

535KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_1602ec0da6dd4ed654e28ffb06b8b890_cobalt-strike_glassworm_icedid_mespinoza_njrat_ryuk_satacom_vidar

kernel32

generic