General
- Target 2026-10-22_4a59c39eeebeb1d1d65861a10d26dde9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.5MB
- Sample261024-rfycqsfb25
- SHA256 d83a8a9e5833bbe4d145f79fc8e62b030f3fefe26b0a3360be4596f9d52af6c1
- MD5 4a59c39eeebeb1d1d65861a10d26dde9
- SHA1 15135b2696feccec37d3fce00d8839d8d2b4f97f
- SHA512 78a0649e34fca1b159cea6c239ae99557cb5b47ebb58813570835b278c43e4a01ca19575eb99a059a25ef995247cdc778c84ebe2516e4e3a452a1f9e45c9ed62
- SSDEEP 98304:Iu3E1KOwgBNfsmDvo75nMrqC4vdqCVDC:JUVXz8aWxdJV
- TLSH T180968D13F2A601E8D05ED974CF3A56329A357C4A4BB0A2EF19D436A11E75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_4a59c39eeebeb1d1d65861a10d26dde9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
22 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_4a59c39eeebeb1d1d65861a10d26dde9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.5MB
- SHA256 d83a8a9e5833bbe4d145f79fc8e62b030f3fefe26b0a3360be4596f9d52af6c1
- MD5 4a59c39eeebeb1d1d65861a10d26dde9
- SHA1 15135b2696feccec37d3fce00d8839d8d2b4f97f
- SHA512 78a0649e34fca1b159cea6c239ae99557cb5b47ebb58813570835b278c43e4a01ca19575eb99a059a25ef995247cdc778c84ebe2516e4e3a452a1f9e45c9ed62
- SSDEEP 98304:Iu3E1KOwgBNfsmDvo75nMrqC4vdqCVDC:JUVXz8aWxdJV
- TLSH T180968D13F2A601E8D05ED974CF3A56329A357C4A4BB0A2EF19D436A11E75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1