2026-10-25_b9d0e9890c9665ea3c008495c8ff8095_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_b9d0e9890c9665ea3c008495c8ff8095_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 347KB
Sample261026-rxl12aev8x
SHA256 a0c952cb891ab61aa8c1cee503643b52b23d99ea154a42dc9238e9afb884638a
MD5 b9d0e9890c9665ea3c008495c8ff8095
SHA1 360c61df22b6c9298c555f0577fb1f5780dafcd6
SHA512 198d131b513140c59df0e813657213d1fb6ad411f90b4dfa315cf8bc3ff56be6d319bde62789a97c4d9f388eb57071b0423a70c214635da5fb85196fae09bf54
SSDEEP 6144:Ury294dYz0cLmkik/Qosy7hq6ujHi4dwBKFxENxpwIV1PHBtRQ6Z:EXocyk/Qobq6ujiBBUEN0AU
TLSH
T155748E19EAA800F9E1B7C178CD574902EBB27C4A0771A6DF23904E961F27BD45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_b9d0e9890c9665ea3c008495c8ff8095_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-25_b9d0e9890c9665ea3c008495c8ff8095_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 347KB

2026-10-25_b9d0e9890c9665ea3c008495c8ff8095_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 9d4f27cc1a17d92ab064907fef140350
SHA256 a0c952cb891ab61aa8c1cee503643b52b23d99ea154a42dc9238e9afb884638a
MD5 b9d0e9890c9665ea3c008495c8ff8095
SHA1 360c61df22b6c9298c555f0577fb1f5780dafcd6
SHA512 198d131b513140c59df0e813657213d1fb6ad411f90b4dfa315cf8bc3ff56be6d319bde62789a97c4d9f388eb57071b0423a70c214635da5fb85196fae09bf54
SSDEEP 6144:Ury294dYz0cLmkik/Qosy7hq6ujHi4dwBKFxENxpwIV1PHBtRQ6Z:EXocyk/Qobq6ujiBBUEN0AU
TLSH
T155748E19EAA800F9E1B7C178CD574902EBB27C4A0771A6DF23904E961F27BD45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

103600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

userenv

DeleteAppContainerProfile GetAppContainerFolderPath DeriveAppContainerSidFromAppContainerName CreateAppContainerProfile

advapi32

FreeSid ConvertStringSidToSidW ConvertSidToStringSidW SetNamedSecurityInfoW SetEntriesInAclW OpenProcessToken CreateWellKnownSid GetTokenInformation

ole32

CoTaskMemFree

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptHashData BCryptDestroyHash

ws2_32

setsockopt ntohs listen htons htonl getsockname connect closesocket bind WSAStartup WSAGetLastError WSACleanup accept socket

kernel32

HeapSize WriteConsoleW SetFileInformationByHandle SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW HeapReAlloc GetOEMCP GetACP IsValidCodePage GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW DeleteFileW GetFileSizeEx ReadFile WriteFile GetTempPathW CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetTickCount64 CreateJobObjectW TerminateJobObject SetInformationJobObject GetModuleFileNameW LocalFree CopyFileW FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsDebuggerPresent RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind

Name

.text

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_b9d0e9890c9665ea3c008495c8ff8095_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

userenv

advapi32

ole32

bcrypt

ws2_32

kernel32

generic