2026-11-06_d5af6de6ecb9e45781e00d68128969ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_d5af6de6ecb9e45781e00d68128969ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom
Size 2.4MB
Sample261107-12rlravyex
SHA256 625bf0f7b87b73b079d9ff6ebbbf8af3c88ae60213010ab92ad12d25a216133a
MD5 d5af6de6ecb9e45781e00d68128969ed
SHA1 5029974716d3c9ac5236a761c5a80f6234e8882c
SHA512 8f2d137d9d9fe9735af96a1863a8da96069d832912e64f3dad41e020c798b4f37c8c60b90f72373a4a9ca23be12fe57f3bedacbba2782fc091fe17fc925061a2
SSDEEP 49152:6WmVUR1v2fSCmpJ0jIhYMTUQea3EjgN6E97XtYWEQ0Vd+paou/WfMoDDyGX:6c2fy+IBTUFaUjg/pgQF
TLSH
T16EC5E10773E6C2E8DA77C1F5C5665622EB3178641B388ADF2160512EDF63BD04E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_d5af6de6ecb9e45781e00d68128969ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

File Explorer

2026-11-06_d5af6de6ecb9e45781e00d68128969ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

.exe 2.4MB

2026-11-06_d5af6de6ecb9e45781e00d68128969ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

IMPHASH bc822e4d86708bab3f4ee2bcf9286cbc
SHA256 625bf0f7b87b73b079d9ff6ebbbf8af3c88ae60213010ab92ad12d25a216133a
MD5 d5af6de6ecb9e45781e00d68128969ed
SHA1 5029974716d3c9ac5236a761c5a80f6234e8882c
SHA512 8f2d137d9d9fe9735af96a1863a8da96069d832912e64f3dad41e020c798b4f37c8c60b90f72373a4a9ca23be12fe57f3bedacbba2782fc091fe17fc925061a2
SSDEEP 49152:6WmVUR1v2fSCmpJ0jIhYMTUQea3EjgN6E97XtYWEQ0Vd+paou/WfMoDDyGX:6c2fy+IBTUFaUjg/pgQF
TLSH
T16EC5E10773E6C2E8DA77C1F5C5665622EB3178641B388ADF2160512EDF63BD04E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

cabinet

CloseDecompressor CreateDecompressor Decompress

user32

MessageBoxW

shell32

CommandLineToArgvW

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-private-l1-1-0

wcsrchr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fflush fwrite setvbuf

api-ms-win-crt-string-l1-1-0

wcscat wcscmp wcscpy wcslen

kernel32

AssignProcessToJobObject CloseHandle CreateDirectoryW CreateFileW CreateJobObjectW CreatePipe CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceW FlushFileBuffers GetCommandLineW GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileSizeEx GetFileType GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleW GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadResource LocalFree LockResource MoveFileExW ReadFile RemoveDirectoryW ResumeThread SetEnvironmentVariableW SetHandleInformation SetInformationJobObject SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron

Name

.text

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_d5af6de6ecb9e45781e00d68128969ed_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom

bcrypt

cabinet

user32

shell32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic