2026-11-02_c1d0bf4e6bf12aecba6b23915370d413_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_c1d0bf4e6bf12aecba6b23915370d413_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 4.3MB
Sample261102-3lsj8ady3y
SHA256 9871c61914d5d2b24064043f265143fc64f9213a615cb82960171b2efdeb67fa
MD5 c1d0bf4e6bf12aecba6b23915370d413
SHA1 a0c15ff57459b997ca154dc755475178eb1fc633
SHA512 8c2811d01b499b72c76e9217a2bd1965af23c52dda7c3cb8e743e14f8b9fff08067f03df18a7ae45147124990aba5d29e26f45f27e7d6add950188bef1dc4480
SSDEEP 49152:R/kVEUSZVN8/mM8lALfzC4NW2kma1MMHrODGhIbiV5E2trJ4eUEmHnXBuAapti3q:rVCv8yqbLrhIHeUr4AgiH
TLSH
T19826BE46A3B640E9C477C039C297B217E672301833649AEB17F04A692F77BE15EBB711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c1d0bf4e6bf12aecba6b23915370d413_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

File Explorer

2026-11-02_c1d0bf4e6bf12aecba6b23915370d413_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

.exe 4.3MB

2026-11-02_c1d0bf4e6bf12aecba6b23915370d413_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

IMPHASH f32c1109e03364f97d6877c44faef344
SHA256 9871c61914d5d2b24064043f265143fc64f9213a615cb82960171b2efdeb67fa
MD5 c1d0bf4e6bf12aecba6b23915370d413
SHA1 a0c15ff57459b997ca154dc755475178eb1fc633
SHA512 8c2811d01b499b72c76e9217a2bd1965af23c52dda7c3cb8e743e14f8b9fff08067f03df18a7ae45147124990aba5d29e26f45f27e7d6add950188bef1dc4480
SSDEEP 49152:R/kVEUSZVN8/mM8lALfzC4NW2kma1MMHrODGhIbiV5E2trJ4eUEmHnXBuAapti3q:rVCv8yqbLrhIHeUr4AgiH
TLSH
T19826BE46A3B640E9C477C039C297B217E672301833649AEB17F04A692F77BE15EBB711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2324768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetForegroundWindow PostThreadMessageA PeekMessageA GetMessageA GetRawInputDeviceList GetRawInputDeviceInfoA EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode UnregisterDeviceNotification RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW DestroyIcon LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx MessageBoxA RemovePropW GetPropW SetPropW ReleaseDC GetDC SetForegroundWindow GetSystemMetrics ReleaseCapture SetCapture MapVirtualKeyW GetKeyState GetActiveWindow SetFocus IsZoomed BringWindowToTop IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos FlashWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SendMessageW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetClientRect

shell32

SHGetSpecialFolderPathW DragAcceptFiles DragFinish DragQueryPoint DragQueryFileW SHGetKnownFolderPath ShellExecuteA

advapi32

CryptDestroyHash CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptAcquireContextA

gdi32

ChoosePixelFormat SetDeviceGammaRamp GetDeviceCaps DeleteDC CreateDCW CreateDIBSection DeleteObject CreateRectRgn CreateBitmap SetPixelFormat DescribePixelFormat SwapBuffers

ole32

PropVariantClear CoInitialize CoInitializeEx CoUninitialize CoTaskMemFree CoCreateInstance StringFromCLSID

ws2_32

__WSAFDIsSet inet_pton WSAIoctl WSASetLastError ntohs htons getsockopt getsockname getpeername connect WSACreateEvent WSACloseEvent WSAGetLastError WSACleanup WSAStartup ioctlsocket closesocket freeaddrinfo getaddrinfo socket shutdown setsockopt sendto send select recvfrom recv listen htonl bind accept

crypt32

CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateChainEngine

winmm

waveOutClose waveOutGetDevCapsW waveInReset waveInStop waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose waveInOpen waveInGetDevCapsW waveInGetNumDevs waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutOpen waveOutGetNumDevs

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

bcrypt

BCryptGenRandom

kernel32

LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FormatMessageW SetLastError GlobalFree GlobalLock GlobalUnlock GlobalAlloc Sleep QueryPerformanceFrequency QueryPerformanceCounter CreateSemaphoreA GetSystemInfo CreateThread WaitForSingleObject ReleaseSemaphore AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock MoveFileExW GetModuleFileNameW CloseHandle GetFileTime GetFileSizeEx FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW CreateDirectoryA SetConsoleTextAttribute WriteConsoleA GetProcessHeap ReadConsoleInputA GetNumberOfConsoleInputEvents WideCharToMultiByte MultiByteToWideChar FormatMessageA GetLastError WriteFile GetStdHandle GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW CreateFileA ReadFile MapViewOfFile UnmapViewOfFile CreateFileMappingA LoadLibraryW GetModuleHandleW SetThreadExecutionState InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree DebugBreak SwitchToThread GetCurrentThread GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapSize GetCurrentDirectoryW SetEndOfFile SetStdHandle GetFileAttributesExW GetTimeZoneInformation FlushFileBuffers HeapReAlloc LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx GetFullPathNameW FreeLibraryAndExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe SetThreadPriority VirtualQuery CreateFileMappingW RaiseException SetEvent ResetEvent CreateEventW GetCurrentThreadId ExitThread GetExitCodeThread GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetFileInformationByHandle GetDriveTypeW GetFileType SetConsoleOutputCP GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess LoadLibraryExW EncodePointer RtlUnwind RtlPcToFileHeader RtlUnwindEx IsDebuggerPresent GetStartupInfoW InitializeSListHead SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess WriteConsoleW GetCurrentProcessId InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent

AmdPowerXpressRequestHighPerformance NvOptimusEnablement alAuxiliaryEffectSlotf alAuxiliaryEffectSlotfv alAuxiliaryEffectSloti alAuxiliaryEffectSlotiv alBuffer3f alBuffer3i alBufferData alBufferSamplesSOFT alBufferStorageSOFT alBufferSubDataSOFT alBufferSubSamplesSOFT alBufferf alBufferfv alBufferi alBufferiv alDeferUpdatesSOFT alDeleteAuxiliaryEffectSlots alDeleteBuffers alDeleteEffects alDeleteFilters alDeleteSources alDisable alDistanceModel alDopplerFactor alDopplerVelocity alEffectf alEffectfv alEffecti alEffectiv alEnable alEventCallbackSOFT alEventControlSOFT alFilterf alFilterfv alFilteri alFilteriv alFlushMappedBufferSOFT alGenAuxiliaryEffectSlots alGenBuffers alGenEffects alGenFilters alGenSources alGetAuxiliaryEffectSlotf alGetAuxiliaryEffectSlotfv alGetAuxiliaryEffectSloti alGetAuxiliaryEffectSlotiv alGetBoolean alGetBooleanv alGetBuffer3f alGetBuffer3i alGetBufferSamplesSOFT alGetBufferf alGetBufferfv alGetBufferi alGetBufferiv alGetDouble alGetDoublev alGetEffectf alGetEffectfv alGetEffecti alGetEffectiv alGetEnumValue alGetError alGetFilterf alGetFilterfv alGetFilteri alGetFilteriv alGetFloat alGetFloatv alGetInteger alGetInteger64SOFT alGetInteger64vSOFT alGetIntegerv alGetListener3f alGetListener3i alGetListenerf alGetListenerfv alGetListeneri alGetListeneriv alGetPointerSOFT alGetPointervSOFT alGetProcAddress alGetSource3dSOFT alGetSource3f alGetSource3i alGetSource3i64SOFT alGetSourcedSOFT alGetSourcedvSOFT alGetSourcef alGetSourcefv alGetSourcei alGetSourcei64SOFT alGetSourcei64vSOFT alGetSourceiv alGetString alGetStringiSOFT alIsAuxiliaryEffectSlot alIsBuffer alIsBufferFormatSupportedSOFT alIsEffect alIsEnabled alIsExtensionPresent alIsFilter alIsSource alListener3f alListener3i alListenerf alListenerfv alListeneri alListeneriv alMapBufferSOFT alProcessUpdatesSOFT alSource3dSOFT alSource3f alSource3i alSource3i64SOFT alSourcePause alSourcePausev alSourcePlay alSourcePlayv alSourceQueueBufferLayersSOFT alSourceQueueBuffers alSourceRewind alSourceRewindv alSourceStop alSourceStopv alSourceUnqueueBuffers alSourcedSOFT alSourcedvSOFT alSourcef alSourcefv alSourcei alSourcei64SOFT alSourcei64vSOFT alSourceiv alSpeedOfSound alUnmapBufferSOFT alcCaptureCloseDevice alcCaptureOpenDevice alcCaptureSamples alcCaptureStart alcCaptureStop alcCloseDevice alcCreateContext alcDestroyContext alcDevicePauseSOFT alcDeviceResumeSOFT alcGetContextsDevice alcGetCurrentContext alcGetEnumValue alcGetError alcGetInteger64vSOFT alcGetIntegerv alcGetProcAddress alcGetString alcGetStringiSOFT alcGetThreadContext alcIsExtensionPresent alcIsRenderFormatSupportedSOFT alcLoopbackOpenDeviceSOFT alcMakeContextCurrent alcOpenDevice alcProcessContext alcRenderSamplesSOFT alcResetDeviceSOFT alcSetThreadContext alcSuspendContext alsoft_get_version

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

574KB

Virtual Size

101.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c1d0bf4e6bf12aecba6b23915370d413_cobalt-strike_glassworm_icedid_njrat_satacom_vidar

user32

shell32

advapi32

gdi32

ole32

ws2_32

crypt32

winmm

imm32

bcrypt

kernel32

generic