2026-10-26_eb0651d149759043ce63df25b6ab8f5d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_eb0651d149759043ce63df25b6ab8f5d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 3.4MB
Sample261027-dxsxpaa16l
SHA256 74c816c135289a38ac97a47720518bcaa24b6ad39d790b4c429cb81a7870764b
MD5 eb0651d149759043ce63df25b6ab8f5d
SHA1 2ac8c1facd81157fc09c528fcbec1d8a7092c7a4
SHA512 81dbb24b77c43fc5697e348b9ca0697df92ade74291aaa762c7eddef0754ac3229a270d195eea2317d684fcc5cc31d390ac9e9881eb12192b3d1f447544652e1
SSDEEP 49152:KnKKhqBS15RUDrUjY8phXuChVXdLWIOqoPMoESCkUdkaACwjNnfYxeocU57JDGAB:iqBS15RTVXdSIOqoPMLhdJijJLodsz0r
TLSH
T13BF55A15A2A810B4D47AD37C89568529FF713FF50B22C9DB1490BA1E3F37AD04E3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_eb0651d149759043ce63df25b6ab8f5d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 3.4MB

2026-10-26_eb0651d149759043ce63df25b6ab8f5d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 27ee1d6c822d4d197d5630e4cfc0fbc1
SHA256 74c816c135289a38ac97a47720518bcaa24b6ad39d790b4c429cb81a7870764b
MD5 eb0651d149759043ce63df25b6ab8f5d
SHA1 2ac8c1facd81157fc09c528fcbec1d8a7092c7a4
SHA512 81dbb24b77c43fc5697e348b9ca0697df92ade74291aaa762c7eddef0754ac3229a270d195eea2317d684fcc5cc31d390ac9e9881eb12192b3d1f447544652e1
SSDEEP 49152:KnKKhqBS15RUDrUjY8phXuChVXdLWIOqoPMoESCkUdkaACwjNnfYxeocU57JDGAB:iqBS15RTVXdSIOqoPMLhdJijJLodsz0r
TLSH
T13BF55A15A2A810B4D47AD37C89568529FF713FF50B22C9DB1490BA1E3F37AD04E3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

6e:6c:af:a1:19:99:9f:ad:5c:86:92:1d:d6:ed:6b:0e:ec:c2:38:b9:bf:c3:d9:90:3b:c3:a0:56:5a:80:f1:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 23, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

1565584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\__w\1\s\RdClient\RdClient.SessionHost\exe\msrdc\bin\x64\Release\msrdc.pdb

shlwapi

PathFindExtensionW PathRemoveFileSpecW PathIsPrefixW ord388 UrlCombineW PathIsNetworkPathW SHGetValueW UrlGetPartW UrlApplySchemeW StrTrimW StrStrIW ord12

ntdll

RtlVirtualUnwind RtlCaptureContext RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader VerSetConditionMask

ncrypt

BCryptDestroyKey BCryptDestroyHash BCryptVerifySignature BCryptFinishHash BCryptGetProperty BCryptHashData BCryptCreateHash BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

api-ms-win-core-path-l1-1-0

PathCchFindExtension PathAllocCanonicalize PathAllocCombine PathCchCombine

dbghelp

SymGetLineFromAddr64 SymGetModuleBase64 SymInitialize SymSetOptions SymFunctionTableAccess64 SymCleanup StackWalk64 SymFromAddr SymGetModuleInfo64

kernel32

CloseThreadpoolWait VirtualProtect VirtualQuery LoadLibraryExA GetSystemTimeAsFileTime FileTimeToSystemTime AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile LocaleNameToLCID CreateFileMappingW MapViewOfFile WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW GetOEMCP IsValidCodePage SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileType GetStdHandle GetModuleHandleExA GetProcAddress FreeLibrary GetLastError HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize FormatMessageW GetProcessHeap OutputDebugStringW GetCurrentThreadId IsDebuggerPresent GetCurrentProcessId WaitForSingleObject SetEvent CreateEventW CreateThread CloseHandle GetExitCodeThread SuspendThread Sleep ResumeThread GetModuleHandleW MultiByteToWideChar GetCommandLineW GetCurrentDirectoryW CreateFileW SetFilePointer GetFileSize ReadFile WideCharToMultiByte DeleteFileW GetModuleHandleExW SetLastError lstrcmpiW lstrcmpW CompareStringOrdinal LocalAlloc LocalFree RaiseException VerifyVersionInfoW GetModuleFileNameW SearchPathW CreateDirectoryW LoadLibraryW MulDiv ResetEvent GetTickCount GetStartupInfoA TerminateProcess GetCurrentProcess DebugBreak GetLocalTime GetTimeFormatW GetDateFormatW DeleteCriticalSection InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection GetACP SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetTickCount64 SetUnhandledExceptionFilter RegisterApplicationRecoveryCallback ApplicationRecoveryInProgress ApplicationRecoveryFinished GetCurrentThread WerRegisterCustomMetadata WerUnregisterCustomMetadata CreateMutexW K32GetModuleFileNameExW HeapSetInformation GetModuleFileNameA CreateSemaphoreExW ReleaseSemaphore ReleaseMutex WaitForSingleObjectEx OpenSemaphoreW DecodePointer CreateMutexExW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetSystemDefaultUILanguage LoadLibraryA ExitProcess ExitThread IsProcessorFeaturePresent UnhandledExceptionFilter FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList InterlockedPushEntrySList InitializeSListHead GetStartupInfoW GetCPInfo LCMapStringEx EncodePointer WakeAllConditionVariable GetSystemTimePreciseAsFileTime SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared GetStringTypeW CancelIo CreateFileA ProcessIdToSessionId CreateProcessW FileTimeToLocalFileTime CreateEventExW GetExitCodeProcess MoveFileW ChangeTimerQueueTimer CreateTimerQueueTimer DeleteTimerQueueTimer QueryFullProcessImageNameW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot ExpandEnvironmentStringsW GetDiskFreeSpaceExW GetTempPathW GetVersionExW SystemTimeToFileTime OpenThread TlsFree TlsGetValue SwitchToThread TlsAlloc InitializeCriticalSection TlsSetValue GetFileAttributesW InitOnceExecuteOnce GetSystemDirectoryW FindClose FindNextFileW FindFirstFileW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTime TrySubmitThreadpoolCallback SetThreadpoolThreadMinimum SetThreadpoolThreadMaximum InitializeCriticalSectionAndSpinCount CompareStringEx GlobalFree LoadLibraryExW DisassociateCurrentThreadFromCallback WaitForThreadpoolTimerCallbacks GetOverlappedResult WriteFile CloseThreadpoolWork DisconnectNamedPipe CreateThreadpoolIo CancelThreadpoolIo StartThreadpoolIo CloseThreadpoolIo WaitForThreadpoolIoCallbacks QueueUserWorkItem WaitForMultipleObjects CancelWaitableTimer SetWaitableTimer CreateThreadpool CreateWaitableTimerExW CreateSemaphoreW CloseThreadpoolTimer SubmitThreadpoolWork IsThreadpoolTimerSet FreeLibraryAndExitThread CloseThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers SetThreadpoolWait SetThreadpoolTimer CreateThreadpoolWait CreateThreadpoolTimer CreateThreadpoolWork CreateThreadpoolCleanupGroup CloseThreadpool GetSystemInfo

user32

SetCursor GetWindowInfo EnumDisplaySettingsW RegisterClassW DefDlgProcW GetClassInfoW IsRectEmpty PostThreadMessageW LoadAcceleratorsW DialogBoxParamW CreateDialogParamW GetKeyboardLayout CharLowerBuffW LoadStringW GetMessageW TranslateMessage DispatchMessageW GetMonitorInfoW GetSystemMetrics IsWindow PostMessageW GetDC ReleaseDC GetWindowThreadProcessId FindWindowExW DestroyMenu TrackPopupMenuEx GetSubMenu LoadMenuW DrawTextW DrawIconEx GetWindowDC IsDialogMessageW TranslateAcceleratorW IsChild ScreenToClient SendDlgItemMessageW EndPaint DrawIcon BeginPaint EndDialog CheckDlgButton SetDlgItemTextW MapWindowPoints NotifyWinEvent GetSysColor SystemParametersInfoW MonitorFromPoint GetMenu GetDlgItem ShowWindowAsync FlashWindowEx GetWindow RedrawWindow AdjustWindowRectEx EnumDisplaySettingsExW FillRect GetCursorPos GetTitleBarInfo SendInput OffsetRect EnableWindow EqualRect SetWindowRgn SetWindowLongW LockWindowUpdate UpdateWindow InvalidateRect SetForegroundWindow IsWindowVisible SetWindowTextW MoveWindow PtInRect EnableMenuItem CheckMenuItem SetMenuItemInfoW GetMenuItemInfoW UnregisterClassW GetClassInfoExW SetWindowPlacement SetTimer GetWindowPlacement IsIconic IsZoomed PostQuitMessage PeekMessageW MsgWaitForMultipleObjectsEx SetWindowPos ModifyMenuW GetSystemMenu DeleteMenu CreateMenu InsertMenuW AppendMenuW KillTimer RegisterWindowMessageW IntersectRect GetWindowLongW GetWindowRect GetDesktopWindow LoadIconW SetFocus DefWindowProcW GetWindowLongPtrW ShowWindow SetWindowLongPtrW CreateWindowExW GetClientRect RegisterClassExW LoadCursorW DestroyWindow SendMessageTimeoutW FindWindowW EnumDisplayDevicesW MonitorFromRect EnumDisplayMonitors SetRect CopyRect DestroyIcon SendMessageW LoadImageW MonitorFromWindow EnumWindows GetWindowTextW GetClassNameW

tdh

TdhGetEventInformation TdhGetEventMapInformation

normaliz

IdnToAscii

dwmapi

DwmGetWindowAttribute

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

576KB

Virtual Size

575KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

63KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1008KB

Virtual Size

1007KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_eb0651d149759043ce63df25b6ab8f5d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

shlwapi

ntdll

ncrypt

api-ms-win-core-path-l1-1-0

dbghelp

kernel32

user32

tdh

normaliz

dwmapi

generic