General
- Target 2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
- Size 1.3MB
- Sample261027-g3rtcs1zd1
- SHA256 caf9f0129f797de021c49e6b5cf6a603e1295b95937d830262c536ba6ae0d90e
- MD5 cfe5005f7a00728b4d94a59ac8961552
- SHA1 711a863112b9ef886eb7a51a3f803f3840ff6fd2
- SHA512 e5da3a8b9caf7408b4ddef7d0eb189d83400860bfd57de863a457922b337c6a9070b100a0cfcf9c6e40152d127663685ef48493cb1718cfa3812c2ca68a4595b
- SSDEEP 24576:VV/9a379UtePLBp9/p/kIL/Z0ooNfQsCXoXMcpZH0YNnQ/tbw/2Mkjy6Fr7g0oS:VCLuePLBp9/p/kILhoOXocccUQ/lFTjG
- TLSH T1C265CF2BA35901FAD06EC1798B565112EA71FC550B74B6DF03A093263E36BE06F3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260911-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
- Size 1.3MB
- SHA256 caf9f0129f797de021c49e6b5cf6a603e1295b95937d830262c536ba6ae0d90e
- MD5 cfe5005f7a00728b4d94a59ac8961552
- SHA1 711a863112b9ef886eb7a51a3f803f3840ff6fd2
- SHA512 e5da3a8b9caf7408b4ddef7d0eb189d83400860bfd57de863a457922b337c6a9070b100a0cfcf9c6e40152d127663685ef48493cb1718cfa3812c2ca68a4595b
- SSDEEP 24576:VV/9a379UtePLBp9/p/kIL/Z0ooNfQsCXoXMcpZH0YNnQ/tbw/2Mkjy6Fr7g0oS:VCLuePLBp9/p/kILhoOXocccUQ/lFTjG
- TLSH T1C265CF2BA35901FAD06EC1798B565112EA71FC550B74B6DF03A093263E36BE06F3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1