General
- Target 2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.5MB
- Sample261024-tt6mdavydz
- SHA256 6a109bedd39b9c9137041c5afd49e919760782406fd97bd1a544a91a7601b6e9
- MD5 39a26cea26ffad338e6b9d3197c1eaf8
- SHA1 c7917cd4c0288b84a425126063955f7598446e1d
- SHA512 b13fe30f1ba0ad261226ee7ff2f2dfc1433ec6b87cba59afcdfd6d57528746854c97db1357e23bae3f7b5c34d682bc4d26e4d3c1cc248f03d1dc5e44ad733f17
- SSDEEP 98304:Du3E1KOwgBNfsmDvo75nMrqC4vdqCVDC:aUVXz8aWxdJV
- TLSH T184968D13F2A601E8D05ED974CF3A56329A357C4A4BB0A2EF19D436A11E75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_39a26cea26ffad338e6b9d3197c1eaf8_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 8.5MB
- SHA256 6a109bedd39b9c9137041c5afd49e919760782406fd97bd1a544a91a7601b6e9
- MD5 39a26cea26ffad338e6b9d3197c1eaf8
- SHA1 c7917cd4c0288b84a425126063955f7598446e1d
- SHA512 b13fe30f1ba0ad261226ee7ff2f2dfc1433ec6b87cba59afcdfd6d57528746854c97db1357e23bae3f7b5c34d682bc4d26e4d3c1cc248f03d1dc5e44ad733f17
- SSDEEP 98304:Du3E1KOwgBNfsmDvo75nMrqC4vdqCVDC:aUVXz8aWxdJV
- TLSH T184968D13F2A601E8D05ED974CF3A56329A357C4A4BB0A2EF19D436A11E75ED47B3CB20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1