General
- Target 2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 6.5MB
- Sample261027-qde8psd19k
- SHA256 e805389d3366fb2e210c3a3e87da2b6a773f8b82af3f362863ec94701717f747
- MD5 830813e39b3479b1b8b852ced2e1b85f
- SHA1 eadbcbe7ebb03c9ab8839efedcb08100e9560cb6
- SHA512 853e129beda2f0cfb355a12f4a6043de39b4e5f15c2f94e302493040de5c417673d20f3c343c5a7132fd5afd3b890234b41c59d39be9a617c5a30bd24d615be4
- SSDEEP 49152:x2DDjNdasG6ML+3QoQHlpoPoFvNwQUF8Q1IJz5RVO3suyXcX36SakvFTCT/M+w3:eHHh3A3tec2nlEw/YbJzl8Nw
- TLSH T13D66AE17F68903F5C09AC17597674272F622BC2A1F2161EF264CB2241F7AEE047BE365
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
- Size 6.5MB
- SHA256 e805389d3366fb2e210c3a3e87da2b6a773f8b82af3f362863ec94701717f747
- MD5 830813e39b3479b1b8b852ced2e1b85f
- SHA1 eadbcbe7ebb03c9ab8839efedcb08100e9560cb6
- SHA512 853e129beda2f0cfb355a12f4a6043de39b4e5f15c2f94e302493040de5c417673d20f3c343c5a7132fd5afd3b890234b41c59d39be9a617c5a30bd24d615be4
- SSDEEP 49152:x2DDjNdasG6ML+3QoQHlpoPoFvNwQUF8Q1IJz5RVO3suyXcX36SakvFTCT/M+w3:eHHh3A3tec2nlEw/YbJzl8Nw
- TLSH T13D66AE17F68903F5C09AC17597674272F622BC2A1F2161EF264CB2241F7AEE047BE365
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1