2026-11-01_f74a0fbddac01f282b070fc6b57811a6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_f74a0fbddac01f282b070fc6b57811a6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 1.7MB
Sample261102-c646msgy2p
SHA256 925a9d35a32e1a6a1ce1ae4b9ff09e289184d4d925d700752c99f15ab04296dd
MD5 f74a0fbddac01f282b070fc6b57811a6
SHA1 6a60d7fb542c4a603f982e8a6f0d6269188b2899
SHA512 01be1c41e8aac03ac846346d5230cdcfe6dbb174ab6a38858f83aaa1caf277397efd55db0d5321e6ca2b41dceca9d06a7a17e49c586582e771b429dc713b1ca7
SSDEEP 24576:MRCHWdzPchRf8DQeR74F66JhyjtRzxDt+GSpnZ/0BtTODJzEvQMNgx:VkxKYODpil
TLSH
T1E585E547EBB651E4D8FAC1398666722BBC71385983349BD797408A474B62FF0E93E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_f74a0fbddac01f282b070fc6b57811a6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-11-01_f74a0fbddac01f282b070fc6b57811a6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 1.7MB

2026-11-01_f74a0fbddac01f282b070fc6b57811a6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 44283d942ff89951d738ee96c0033e23
SHA256 925a9d35a32e1a6a1ce1ae4b9ff09e289184d4d925d700752c99f15ab04296dd
MD5 f74a0fbddac01f282b070fc6b57811a6
SHA1 6a60d7fb542c4a603f982e8a6f0d6269188b2899
SHA512 01be1c41e8aac03ac846346d5230cdcfe6dbb174ab6a38858f83aaa1caf277397efd55db0d5321e6ca2b41dceca9d06a7a17e49c586582e771b429dc713b1ca7
SSDEEP 24576:MRCHWdzPchRf8DQeR74F66JhyjtRzxDt+GSpnZ/0BtTODJzEvQMNgx:VkxKYODpil
TLSH
T1E585E547EBB651E4D8FAC1398666722BBC71385983349BD797408A474B62FF0E93E340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1295088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW Process32NextW PeekNamedPipe AllocConsole FreeConsole GetConsoleCP SetConsoleCP SetConsoleOutputCP GetConsoleWindow DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection CreateDirectoryW FindClose FindFirstFileW FindNextFileW CopyFileW EnterCriticalSection LeaveCriticalSection HeapAlloc HeapReAlloc HeapFree GetProcessHeap CreateThread GetCurrentThreadId GlobalAlloc GlobalUnlock GlobalLock MulDiv K32GetProcessImageFileNameW GetLocalTime GetModuleHandleW GetExitCodeProcess SetEvent GetFileType GetFinalPathNameByHandleW DuplicateHandle SetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryFullProcessImageNameW GetCurrentDirectoryW GetModuleHandleExW FlushFileBuffers GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetCurrentProcessId LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate WideCharToMultiByte GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI TryEnterCriticalSection CreateMutexA SetCurrentDirectoryW HeapSetInformation GetTempFileNameW WriteConsoleW ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx EncodePointer IsDebuggerPresent InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter MultiByteToWideChar GetComputerNameW OpenProcess ReadFile GetFileSize DeleteFileW CreateFileW ExpandEnvironmentStringsW GetCurrentProcess LocalFree LocalAlloc LoadLibraryW GetProcAddress TerminateProcess CreateEventW WaitForDebugEvent ContinueDebugEvent GetCommandLineW CreateProcessW Sleep WaitForSingleObject CreatePipe CloseHandle WriteFile SetThreadExecutionState CreateToolhelp32Snapshot GetModuleFileNameW GetComputerNameExW ExitProcess CreateMutexW InitializeCriticalSection GetLastError GetFileAttributesW RtlUnwind

user32

CreateDesktopW OpenDesktopW SetThreadDesktop CloseDesktop GetMessageW UpdateWindow DestroyWindow SendMessageW DispatchMessageW PostMessageW IsWindow PrintWindow MoveWindow BeginPaint IsWindowVisible OpenClipboard CloseClipboard SetClipboardData ShowWindow TranslateMessage GetSystemMetrics GetDC GetWindowDC ReleaseDC GetWindowTextW GetWindowRect GetCursorPos GetWindowLongW SetWindowLongW EnumChildWindows EnumWindows GetClassNameW GetWindowThreadProcessId MonitorFromWindow GetMonitorInfoW SetWinEventHook ToUnicodeEx GetKeyboardLayout AttachThreadInput DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW GetClipboardData IsClipboardFormatAvailable AddClipboardFormatListener GetKeyState GetKeyboardState GetForegroundWindow UnhookWinEvent SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx MessageBoxW SetProcessDpiAwarenessContext OpenInputDesktop SendInput EndPaint InvalidateRect GetClientRect SetCursor FillRect LoadCursorW EmptyClipboard PostThreadMessageW ChangeDisplaySettingsExW SetDisplayConfig EnumDisplayMonitors SetWindowPos

gdi32

StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC GetPixel CreateSolidBrush CreateCompatibleBitmap CreateDIBSection

comdlg32

GetFileTitleW

advapi32

SetThreadToken GetTokenInformation OpenProcessToken CreateWellKnownSid GetUserNameW SetNamedSecurityInfoW SetEntriesInAclW FreeSid AllocateAndInitializeSid RegGetValueW RegOpenKeyExW RegCloseKey ConvertSidToStringSidW LookupAccountNameW RevertToSelf DuplicateTokenEx

shell32

ShellExecuteW CommandLineToArgvW

ole32

CoTaskMemFree CoInitializeEx CoInitializeSecurity PropVariantClear CoCreateGuid CoInitialize CoCreateInstance CoUninitialize CreateStreamOnHGlobal

oleaut32

VariantClear SysAllocString VariantInit

shlwapi

PathStripPathW PathFileExistsW ord219

ntdll

NtQueryInformationProcess NtDuplicateObject NtClose DbgUiSetThreadDebugObject NtRemoveProcessDebug

rpcrt4

RpcAsyncInitializeHandle RpcBindingFromStringBindingW RpcStringBindingComposeW NdrAsyncClientCall RpcAsyncCompleteCall RpcBindingFree RpcRaiseException RpcBindingSetAuthInfoExW RpcStringFreeW

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData

bcrypt

BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptDecrypt BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGenerateSymmetricKey

version

VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW

ncrypt

NCryptOpenStorageProvider NCryptDecrypt NCryptFreeObject NCryptOpenKey

gdiplus

GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipGetImageEncodersSize

ws2_32

send select freeaddrinfo getaddrinfo socket connect shutdown closesocket WSAStartup getsockname gethostbyname ioctlsocket recv

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpConnect WinHttpQueryDataAvailable

mfplat

MFCopyImage MFStartup MFGetStrideForBitmapInfoHeader MFCreateAttributes MFShutdown MFCreateSourceResolver

mf

MFGetService MFEnumDeviceSources MFCreateVideoRendererActivate MFCreateAudioRendererActivate MFCreateMediaSession MFCreateTopology MFCreateTopologyNode

mfreadwrite

MFCreateSourceReaderFromMediaSource

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_f74a0fbddac01f282b070fc6b57811a6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

ntdll

rpcrt4

crypt32

bcrypt

version

ncrypt

gdiplus

ws2_32

winhttp

mfplat

mf

mfreadwrite

generic