2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 4.8MB
Sample261027-csswfsay4n
SHA256 c89423efc522db862e3acd855ef99ae3e1af69384571579db0a07a38d665c802
MD5 f3df558c4b27b6b935d2466fb954c1da
SHA1 4d10f00c7dc3a49de9e84c3c94e34b371f88d2ff
SHA512 135170d51a0a9abf652545fa88a51fe8e7c4a907468dbd82947286fd8b7ca78a0c77fd23ea31aaa5eb6e48f4b62693d7741f69d3f7686a85e3017a6881d183dc
SSDEEP 49152:oLT31iAVS5qQ5JnAPqUs5XjPo/iwEkoT56zFUZGSFwZMuAsDbvtftlW4aqaJvmva:IiL1GSejJzratmRqiiratm
TLSH
T157366B0273E90B89F2F78778C936A2129476BC299B11D7EF1654414E1F23BE08979B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 4.8MB

2026-10-26_f3df558c4b27b6b935d2466fb954c1da_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH 9fed93abb265fdd3beaa711f74a32268
SHA256 c89423efc522db862e3acd855ef99ae3e1af69384571579db0a07a38d665c802
MD5 f3df558c4b27b6b935d2466fb954c1da
SHA1 4d10f00c7dc3a49de9e84c3c94e34b371f88d2ff
SHA512 135170d51a0a9abf652545fa88a51fe8e7c4a907468dbd82947286fd8b7ca78a0c77fd23ea31aaa5eb6e48f4b62693d7741f69d3f7686a85e3017a6881d183dc
SSDEEP 49152:oLT31iAVS5qQ5JnAPqUs5XjPo/iwEkoT56zFUZGSFwZMuAsDbvtftlW4aqaJvmva:IiL1GSejJzratmRqiiratm
TLSH
T157366B0273E90B89F2F78778C936A2129476BC299B11D7EF1654414E1F23BE08979B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1302304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\dptf\Src\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\ipf_uf.pdb

kernel32

GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetSystemPowerStatus WideCharToMultiByte GetTimeZoneInformation GetFileAttributesExW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode SetStdHandle GetCurrentDirectoryW GetOEMCP GetThreadId GetCurrentThreadId SetCurrentDirectoryW GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler RaiseException GetStringTypeW HeapReAlloc MoveFileExW EnumSystemLocalesW CreateFileA DeviceIoControl GetUserDefaultLCID GetEnvironmentVariableA GetTempPathW GetTempPathA SetLastError CreateMutexA SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW HeapSize OpenProcess SetEndOfFile GetTickCount64 CreateMutexW ReleaseMutex OutputDebugStringA WaitForMultipleObjects FormatMessageA WriteConsoleW LoadLibraryExW IsValidLocale GetLocaleInfoW TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetStdHandle GetCommandLineW GetExitCodeProcess ExitThread GetExitCodeThread CreateProcessW AddDllDirectory SetDllDirectoryW WriteConsoleInputW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult LocalFree CloseHandle LoadLibraryExA GetProcAddress GetModuleHandleExA FreeLibrary GetLastError AcquireSRWLockShared ReleaseSRWLockShared GetFileAttributesA LocalAlloc FindNextFileA FindFirstFileA FindClose QueryPerformanceFrequency QueryPerformanceCounter CreateThread WTSGetActiveConsoleSessionId TlsFree TlsSetValue CreateDirectoryW RemoveDirectoryW CopyFileW GetCurrentProcess CreateSemaphoreW Sleep CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock DuplicateHandle TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount OutputDebugStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetFileAttributesW GetModuleHandleW VerifyVersionInfoW VerSetConditionMask GetFullPathNameW CreateProcessA MultiByteToWideChar GetCurrentThread HeapAlloc HeapFree GetCommandLineA ExitProcess FileTimeToSystemTime DeleteFileW SystemTimeToTzSpecificLocalTime PeekNamedPipe RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent __C_specific_handler WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DeleteCriticalSection GetDriveTypeW GetFileInformationByHandle GetFileType RtlUnwind

powrprof

PowerRemovePowerSetting PowerReadACValueIndex PowerReadDCValueIndex CallNtPowerInformation PowerWriteSettingAttributes SetSuspendState

ole32

CoDecrementMTAUsage CoIncrementMTAUsage CoInitializeEx StringFromCLSID CoTaskMemFree CoCreateInstance PropVariantClear CoUninitialize CoCreateGuid StringFromGUID2

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal WindowsCreateString WindowsCreateStringReference WindowsDuplicateString WindowsDeleteString WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

setupapi

CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Get_DevNode_Registry_PropertyW CM_Get_Parent CM_Get_Sibling CM_Locate_DevNodeW CM_Get_Child

api-ms-win-power-setting-l1-1-0

PowerWriteDCValueIndex PowerWriteACValueIndex PowerSettingUnregisterNotification PowerSettingRegisterNotification PowerSetActiveScheme PowerGetActiveScheme

advapi32

AddAccessAllowedAce StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W DuplicateTokenEx CreateProcessAsUserW ConvertStringSidToSidW ConvertSidToStringSidA GetUserNameA LookupAccountNameA SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce OpenProcessToken RegGetValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyExW RegCreateKeyExW RegCloseKey EventUnregister CloseTrace ProcessTrace OpenTraceW EnableTraceEx ControlTraceW StartTraceW EventWriteString EventProviderEnabled EventWrite EventRegister

tdh

TdhGetEventInformation TdhGetProperty TdhGetPropertySize

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ctlAUXAccess ctlCheckDriverVersion ctlClose ctlEngineGetActivity ctlEngineGetProperties ctlEnumEngineGroups ctlEnumFans ctlEnumFrequencyDomains ctlEnumMemoryModules ctlEnumPowerDomains ctlEnumTemperatureSensors ctlEnumerateDevices ctlEnumerateDisplayOutputs ctlEnumerateMuxDevices ctlFanGetConfig ctlFanGetProperties ctlFanGetState ctlFanSetDefaultMode ctlFanSetFixedSpeedMode ctlFanSetSpeedTableMode ctlFrequencyGetAvailableClocks ctlFrequencyGetProperties ctlFrequencyGetRange ctlFrequencyGetState ctlFrequencyGetThrottleTime ctlFrequencySetRange ctlGetAdaperDisplayEncoderProperties ctlGetBrightnessSetting ctlGetCurrentScaling ctlGetCurrentSharpness ctlGetDeviceProperties ctlGetDisplayProperties ctlGetIntelArcSyncInfoForMonitor ctlGetIntelArcSyncProfile ctlGetLACEConfig ctlGetMuxProperties ctlGetPowerOptimizationCaps ctlGetPowerOptimizationSetting ctlGetSet3DFeature ctlGetSetRetroScaling ctlGetSetVideoProcessingFeature ctlGetSharpnessCaps ctlGetSupported3DCapabilities ctlGetSupportedRetroScalingCapability ctlGetSupportedScalingCapability ctlGetSupportedVideoProcessingCapabilities ctlGetZeDevice ctlI2CAccess ctlInit ctlMemoryGetBandwidth ctlMemoryGetProperties ctlMemoryGetState ctlOverclockGetProperties ctlOverclockGpuFrequencyOffsetGet ctlOverclockGpuFrequencyOffsetSet ctlOverclockGpuLockGet ctlOverclockGpuLockSet ctlOverclockGpuVoltageOffsetGet ctlOverclockGpuVoltageOffsetSet ctlOverclockPowerLimitGet ctlOverclockPowerLimitSet ctlOverclockTemperatureLimitGet ctlOverclockTemperatureLimitSet ctlOverclockVramFrequencyOffsetGet ctlOverclockVramFrequencyOffsetSet ctlOverclockVramVoltageOffsetGet ctlOverclockVramVoltageOffsetSet ctlOverclockWaiverSet ctlPanelDescriptorAccess ctlPciGetProperties ctlPciGetState ctlPixelTransformationGetConfig ctlPixelTransformationSetConfig ctlPowerGetEnergyCounter ctlPowerGetLimits ctlPowerGetProperties ctlPowerSetLimits ctlPowerTelemetryGet ctlReservedCall ctlSetBrightnessSetting ctlSetCurrentScaling ctlSetCurrentSharpness ctlSetIntelArcSyncProfile ctlSetLACEConfig ctlSetPowerOptimizationSetting ctlSetRuntimePath ctlSoftwarePSR ctlSwitchMux ctlTemperatureGetProperties ctlTemperatureGetState ctlWaitForPropertyChange

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

86KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATL

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=11, id=259, version=27412,

count=201, id=261, version=27412,

count=15, id=260, version=27412,

count=46, id=261, version=28920,

count=18, id=260, version=28920,

count=9, id=259, version=28920,

count=1, id=263, version=27412,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=262, id=1, productName=Unmarked objects,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=261, productName=VS2019 v16.7.0 build 29110, version=29110,

count=70, id=260, productName=VS2019 v16.7.0 build 29110, version=29110,

count=1, id=256, productName=VS2019 v16.7.0 build 29110, version=29110,

count=1, id=255, productName=VS2019 v16.7.0 build 29110, version=29110,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.7.0 build 29110, version=29110,