2026-10-28_755905216066c7686904119d6996b6d1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_755905216066c7686904119d6996b6d1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.9MB
Sample261030-caeacavy2p
SHA256 871bc9a2542761f78cb0e15af6bc841a74f511f80cbf46a2eca27648389d5314
MD5 755905216066c7686904119d6996b6d1
SHA1 159f7066d8bdfb80e8db7853f8685b5118ff1739
SHA512 0487333ffec38cb68e9e7b8bc13c25a531643743f43d4899fa68b465da981ca9ba3b4d5898431602fa22dfdb1a72fd3e36845f238589740bbad3571e5bb248a7
SSDEEP 49152:pdPKKgVkbLHveKgdEWwRO7Glt9xJ9q0LDM+:fbI2HveXk2
TLSH
T1D3E53A4AAA7941E1C0BBD07CC683652BFD7134A68331A7D766859B171F23BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_755905216066c7686904119d6996b6d1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-28_755905216066c7686904119d6996b6d1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.9MB

2026-10-28_755905216066c7686904119d6996b6d1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH e5537f68413cf3558a382aa255c3ac84
SHA256 871bc9a2542761f78cb0e15af6bc841a74f511f80cbf46a2eca27648389d5314
MD5 755905216066c7686904119d6996b6d1
SHA1 159f7066d8bdfb80e8db7853f8685b5118ff1739
SHA512 0487333ffec38cb68e9e7b8bc13c25a531643743f43d4899fa68b465da981ca9ba3b4d5898431602fa22dfdb1a72fd3e36845f238589740bbad3571e5bb248a7
SSDEEP 49152:pdPKKgVkbLHveKgdEWwRO7Glt9xJ9q0LDM+:fbI2HveXk2
TLSH
T1D3E53A4AAA7941E1C0BBD07CC683652BFD7134A68331A7D766859B171F23BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1364432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileAttributesA TerminateProcess CreateProcessA OpenProcess GetEnvironmentVariableA GetTempPathA GetCurrentProcessId ExitProcess GetModuleFileNameW QueryFullProcessImageNameA GetComputerNameW DecodePointer HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx Process32First Process32Next MultiByteToWideChar Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateWaitableTimerA SetWaitableTimer CreateEventW SleepEx InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateIoCompletionPort SetLastError WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetModuleFileNameA TerminateThread QueueUserAPC SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect WaitForMultipleObjects CreateEventA CreateMutexA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus GetLastError CloseHandle UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RaiseException WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EncodePointer LCMapStringEx GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetCurrentProcess InitializeCriticalSection ResumeThread GetSystemInfo VirtualAllocEx VirtualFreeEx CreateActCtxW WriteFile CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetWindowsDirectoryW GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First ReadFile CreateNamedPipeW CreateThread GetProcessId IsWow64Process WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx LoadLibraryW FreeLibrary SuspendThread GetThreadTimes OpenThread IsDebuggerPresent OutputDebugStringW RtlLookupFunctionEntry RtlUnwindEx RtlUnwind

user32

wsprintfW

advapi32

RegOpenKeyExA AdjustTokenPrivileges OpenProcessToken RegCloseKey RegDeleteValueA RegNotifyChangeKeyValue RegQueryValueExA RegSetValueExA RegCreateKeyExA RegOpenKeyExW OpenThreadToken RegEnumValueW RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyW RegSetValueExW RegQueryValueExW LookupPrivilegeValueW

shell32

ShellExecuteA

ws2_32

ioctlsocket WSAStartup WSACleanup connect closesocket select WSAStringToAddressW getsockopt listen htons htonl bind accept freeaddrinfo getaddrinfo WSASocketW WSASend WSARecv WSAGetLastError WSASetLastError shutdown setsockopt ntohl

bcrypt

BCryptCloseAlgorithmProvider BCryptEncrypt BCryptImportKeyPair BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptGenRandom BCryptFinishHash

wininet

InternetSetOptionA

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty CertAddCertificateContextToStore PFXImportCertStore CertDeleteCertificateFromStore CryptUnprotectData

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpAddRequestHeaders WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts

ole32

CoCreateInstance CoUninitialize CoInitialize

shlwapi

SHDeleteKeyW

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_755905216066c7686904119d6996b6d1_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

wininet

crypt32

winhttp

ole32

shlwapi

oleaut32

generic