2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar
Size 1.3MB
Sample261027-g3rtcs1zd1
SHA256 caf9f0129f797de021c49e6b5cf6a603e1295b95937d830262c536ba6ae0d90e
MD5 cfe5005f7a00728b4d94a59ac8961552
SHA1 711a863112b9ef886eb7a51a3f803f3840ff6fd2
SHA512 e5da3a8b9caf7408b4ddef7d0eb189d83400860bfd57de863a457922b337c6a9070b100a0cfcf9c6e40152d127663685ef48493cb1718cfa3812c2ca68a4595b
SSDEEP 24576:VV/9a379UtePLBp9/p/kIL/Z0ooNfQsCXoXMcpZH0YNnQ/tbw/2Mkjy6Fr7g0oS:VCLuePLBp9/p/kILhoOXocccUQ/lFTjG
TLSH
T1C265CF2BA35901FAD06EC1798B565112EA71FC550B74B6DF03A093263E36BE06F3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

File Explorer

2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

.exe 1.3MB

2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

IMPHASH a77aec4bcfe8ef82b697278e7f862e25
SHA256 caf9f0129f797de021c49e6b5cf6a603e1295b95937d830262c536ba6ae0d90e
MD5 cfe5005f7a00728b4d94a59ac8961552
SHA1 711a863112b9ef886eb7a51a3f803f3840ff6fd2
SHA512 e5da3a8b9caf7408b4ddef7d0eb189d83400860bfd57de863a457922b337c6a9070b100a0cfcf9c6e40152d127663685ef48493cb1718cfa3812c2ca68a4595b
SSDEEP 24576:VV/9a379UtePLBp9/p/kIL/Z0ooNfQsCXoXMcpZH0YNnQ/tbw/2Mkjy6Fr7g0oS:VCLuePLBp9/p/kILhoOXocccUQ/lFTjG
TLSH
T1C265CF2BA35901FAD06EC1798B565112EA71FC550B74B6DF03A093263E36BE06F3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

447616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ClearCommBreak CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommState GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA GlobalMemoryStatus HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalAlloc LocalFileTimeToFileTime LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCommBreak SetCommState SetCommTimeouts SetConsoleMode SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

user32

FindWindowA GetCapture GetClipboardOwner GetCursorPos GetForegroundWindow GetQueueStatus SendMessageA

advapi32

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyA RegOpenKeyA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

Name

.text

Size

600KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_cfe5005f7a00728b4d94a59ac8961552_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar

kernel32

user32

advapi32

generic