2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

General

Target
2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 2.2MB
Sample261027-wpb83sfy8j
SHA256 ce5fb2dae8b36ff491e62703f3937241f53ec44bcb6031c28f86b04068760ca3
MD5 4c2879affe0570cb359d0bd1b21c084c
SHA1 63fb2956661d5ba9ac3380f4dfe45dc7cdfde047
SHA512 46464ab6a1bc5ce0e6914baa1116dbe368c55bc38c0f895d5ec80d3ecb11c61b78533061bb259cf6c5b2b2d9f1fced2e4a1173ae2970059e62d3159e4993ae13
SSDEEP 49152:WoyibzBhJ6Sd2Vm1GzeD9mWQLkwwNjCRB6NRQzeq+T9DoUU926RAcJXazD8Arp4B:Woy6BhJ6S2Vgt0RAcJ89TETLZUY
TLSH
T152B5BF46A36504E8C97BC2788A16A507E3F2741507709EEF66E14BE61F13EE21E7FB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 2.2MB

2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH cd9fc0c79dc98ba82ef45c1d252399b7
SHA256 ce5fb2dae8b36ff491e62703f3937241f53ec44bcb6031c28f86b04068760ca3
MD5 4c2879affe0570cb359d0bd1b21c084c
SHA1 63fb2956661d5ba9ac3380f4dfe45dc7cdfde047
SHA512 46464ab6a1bc5ce0e6914baa1116dbe368c55bc38c0f895d5ec80d3ecb11c61b78533061bb259cf6c5b2b2d9f1fced2e4a1173ae2970059e62d3159e4993ae13
SSDEEP 49152:WoyibzBhJ6Sd2Vm1GzeD9mWQLkwwNjCRB6NRQzeq+T9DoUU926RAcJXazD8Arp4B:Woy6BhJ6S2Vgt0RAcJ89TETLZUY
TLSH
T152B5BF46A36504E8C97BC2788A16A507E3F2741507709EEF66E14BE61F13EE21E7FB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1098156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage CharLowerA SetScrollInfo LoadIconA LoadCursorA FillRect MessageBoxA ScrollWindowEx InvalidateRect EndPaint BeginPaint GetDC UpdateWindow LoadAcceleratorsA GetFocus ShowWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA DispatchMessageA GetMessageA

advapi32

GetUserNameA

gdi32

LineTo SelectObject CreateCompatibleDC CreateCompatibleBitmap BitBlt GetStockObject PatBlt MoveToEx

kernel32

GetFullPathNameW GetCurrentDirectoryW GetTimeZoneInformation OutputDebugStringW HeapReAlloc SetFilePointerEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID GetCPInfo SetEnvironmentVariableW SetEndOfFile FindFirstFileExW IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetProcessHeap GetFileSizeEx GetCurrentProcessId IsValidLocale GetLocaleInfoW SearchPathA Sleep SetConsoleCtrlHandler GetLastError ReleaseMutex WaitForSingleObject CreateMutexA GetModuleFileNameA GetModuleHandleA LocalFree FormatMessageA FreeLibrary GetProcAddress LoadLibraryExA CreateFileW DeleteFileW GetTempFileNameW GetTempPathW CloseHandle FindClose FindFirstFileA GetVersion GetStdHandle GetCommandLineW MultiByteToWideChar WideCharToMultiByte ReadConsoleW WriteConsoleW AreFileApisANSI GetACP GetOEMCP GetFileAttributesW GetExitCodeProcess FindFirstFileW FindNextFileW GetFileInformationByHandle GetFileAttributesA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter HeapSize GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW LCMapStringW RtlUnwindEx RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ReadFile ExitProcess GetModuleHandleExW GetFileType GetModuleFileNameW GetFileAttributesExW GetDriveTypeW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread QueryPerformanceFrequency SetStdHandle DuplicateHandle CreateProcessW CreatePipe GetConsoleMode MoveFileExW WriteFile GetCommandLineA HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

258KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

15.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_4c2879affe0570cb359d0bd1b21c084c_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

user32

advapi32

gdi32

kernel32

generic