2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.0MB
Sample261102-1vmzzsdv3y
SHA256 4e16a07d350588ac97fbf84a87ffe415979e7296dc8fe4efcc1430ddbb3b55eb
MD5 d1bc408a25e7937ee5eafb0d64db612d
SHA1 475a02c5aa298d644d7bff6bb1380b3107e96a14
SHA512 dd5607c3c6ac845f3a30c665ac6074b3f604ab1e1c18175e539b38c25fe1f94b9a22d656090e40bc75b1fd12ee603ca00eca9f3f6da06ef519c5e4681b9964ee
SSDEEP 49152:lP0SwhbbPrdn8ybPGg9V1LWY5xedMahpJAFC:ZsoQInn
TLSH
T1B8A59E1AA27901FCD1E7C179CE475907EBB2B40903319BDB12D0DA661F23AE15F7A728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.0MB

2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 01996c9bfe0205c6b560c2284dd0e018
SHA256 4e16a07d350588ac97fbf84a87ffe415979e7296dc8fe4efcc1430ddbb3b55eb
MD5 d1bc408a25e7937ee5eafb0d64db612d
SHA1 475a02c5aa298d644d7bff6bb1380b3107e96a14
SHA512 dd5607c3c6ac845f3a30c665ac6074b3f604ab1e1c18175e539b38c25fe1f94b9a22d656090e40bc75b1fd12ee603ca00eca9f3f6da06ef519c5e4681b9964ee
SSDEEP 49152:lP0SwhbbPrdn8ybPGg9V1LWY5xedMahpJAFC:ZsoQInn
TLSH
T1B8A59E1AA27901FCD1E7C179CE475907EBB2B40903319BDB12D0DA661F23AE15F7A728
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables containing possible sandbox analysis VM names
Detects executables containing possible sandbox analysis VM usernames
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1404576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetLastError GetFileAttributesA Process32NextW MoveFileExA CreateFileA DeleteFileA Process32FirstW WideCharToMultiByte CreateMutexW AttachConsole GetConsoleProcessList GetLocalTime GetConsoleWindow AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileW HeapReAlloc RaiseException GetSystemInfo TerminateProcess HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetTickCount64 GetFileSizeEx GetNativeSystemInfo GetComputerNameW GlobalMemoryStatusEx SetThreadPriority SetFileAttributesW GetCurrentThread CreateProcessW VirtualProtect GetModuleHandleA QueryPerformanceFrequency IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent GetModuleHandleW WriteConsoleW WriteFile GetCurrentProcess ReadFile FreeLibrary GetProcAddress LoadLibraryW LocalFree WTSGetActiveConsoleSessionId CloseHandle CopyFileA Sleep WaitForSingleObject SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetExitCodeProcess ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW RtlUnwind LCMapStringW HeapAlloc GetModuleFileNameA CompareStringW LoadLibraryExW GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 CopyFile2 GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo WakeAllConditionVariable GetStringTypeW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError

advapi32

RegSetValueExW GetTokenInformation GetUserNameA RegDeleteValueW RegCloseKey RegCreateKeyExW CreateProcessAsUserW RegOpenKeyExW RegQueryValueExW GetUserNameW OpenProcessToken

shell32

SHGetFolderPathW ShellExecuteExW

ole32

CoSetProxyBlanket CoInitializeEx CoInitializeSecurity CoCreateInstance CoUninitialize

oleaut32

SysFreeString SysStringByteLen SysAllocStringByteLen SysAllocString VariantInit VariantClear

crypt32

CryptStringToBinaryA

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptEncrypt BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

winhttp

WinHttpOpenRequest WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpSetOption WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpCrackUrl WinHttpConnect

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

advapi32

shell32

ole32

oleaut32

crypt32

bcrypt

wtsapi32

winhttp

generic