2026-11-07_cede57be207e64e4559b29e7b2f8d446_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_cede57be207e64e4559b29e7b2f8d446_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 9.0MB
Sample261107-l2vabaxwcs
SHA256 e699a78c9b80bef8858dd432c111fc1011604a8f4694a2fac63f099b36d68603
MD5 cede57be207e64e4559b29e7b2f8d446
SHA1 6bbdd9c3216bd66c4c1d8a9c8bd2b7b94a957a48
SHA512 4444d64be6efe274683f9794b883b76a2f203e2ad728676ed3e241f8f2252c64ca54cbba27b24ca032f89ef7dd6c8d7eea02076c52905a227dfeb86f23a2252c
SSDEEP 196608:dlY1r6YjowpKEkcuHNbJ8DSIZN7GckMi3Jg:IfcjEkcuhJ8zZNPkV
TLSH
T15996CF7662A841ECD07AE0B99B576C03E375344A03316EEB16E045621F275E46FFFE22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_cede57be207e64e4559b29e7b2f8d446_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-11-07_cede57be207e64e4559b29e7b2f8d446_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 9.0MB

2026-11-07_cede57be207e64e4559b29e7b2f8d446_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 42bdd7c6cfed12f30ca3ed39de494cfb
SHA256 e699a78c9b80bef8858dd432c111fc1011604a8f4694a2fac63f099b36d68603
MD5 cede57be207e64e4559b29e7b2f8d446
SHA1 6bbdd9c3216bd66c4c1d8a9c8bd2b7b94a957a48
SHA512 4444d64be6efe274683f9794b883b76a2f203e2ad728676ed3e241f8f2252c64ca54cbba27b24ca032f89ef7dd6c8d7eea02076c52905a227dfeb86f23a2252c
SSDEEP 196608:dlY1r6YjowpKEkcuHNbJ8DSIZN7GckMi3Jg:IfcjEkcuhJ8zZNPkV
TLSH
T15996CF7662A841ECD07AE0B99B576C03E375344A03316EEB16E045621F275E46FFFE22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4078720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\PROJECT\Open SF\OpenSF-Client-main\OpenSF-Client-main\bin\legacysf.pdb

d3d12

ord102 ord101 D3D12SerializeRootSignature

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3dcompiler_47

D3DCompile

gdi32

GetStockObject GetDeviceCaps

user32

SystemParametersInfoW MonitorFromPoint MonitorFromWindow MessageBoxW TranslateMessage DispatchMessageW PeekMessageW SetWindowLongPtrW DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow GetMonitorInfoW SetProcessDPIAware GetRawInputData RegisterRawInputDevices GetKeyboardLayout LoadIconW GetMessageExtraInfo DefWindowProcA UnregisterClassW SetLayeredWindowAttributes IsIconic BringWindowToTop SetFocus GetWindowLongPtrW GetCapture IsWindowUnicode GetForegroundWindow SetForegroundWindow GetDC ReleaseDC AdjustWindowRectEx SetCursor GetWindowLongW EnumDisplaySettingsW TrackMouseEvent ShowWindow SetWindowPos MapVirtualKeyW SetCapture ReleaseCapture GetSystemMetrics SetWindowLongW LoadCursorA GetMonitorInfoA ClipCursor ScreenToClient ClientToScreen AdjustWindowRect GetCursorPos EnumDisplayMonitors OpenClipboard UpdateWindow SetWindowTextW GetClientRect GetWindowRect LoadCursorW SetCursorPos ShowCursor GetKeyState CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

xinput1_4

ord3 ord2

hid

HidD_GetFeature HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidP_GetCaps

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces

winmm

timeEndPeriod timeBeginPeriod

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx

shlwapi

ord12

ws2_32

sendto setsockopt socket htonl WSACleanup WSAGetLastError WSAIoctl getaddrinfo ntohs accept listen recv send getsockname ioctlsocket closesocket bind recvfrom ntohl freeaddrinfo htons WSAStartup

dbghelp

SymFromAddr SymInitialize SymGetLineFromAddr64 SymGetModuleBase64 StackWalk64 SymSetOptions SymFunctionTableAccess64

winhttp

WinHttpSetTimeouts WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpOpenRequest

bcrypt

BCryptGenRandom BCryptHash

crypt32

CryptUnprotectData CryptProtectData

kernel32

GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess ExitProcess IsProcessorFeaturePresent FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork GetConsoleMode HeapReAlloc IsValidCodePage GetACP ReadConsoleW InitOnceComplete InitOnceBeginInitialize RaiseException GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetSystemTimePreciseAsFileTime AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetTempPathW SetFileTime SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW FormatMessageA FreeLibraryWhenCallbackReturns SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetSystemInfo Sleep CreateWaitableTimerExW SetWaitableTimer SetConsoleTextAttribute GetStdHandle SetFilePointerEx GetFileSizeEx FlushFileBuffers GetModuleHandleExA GetModuleFileNameA GetCurrentThread SetUnhandledExceptionFilter GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetSystemPowerStatus OutputDebugStringA IsDBCSLeadByte VirtualQuery LoadLibraryExA DeleteFileW GetCommandLineW LocalFree SetDllDirectoryW AllocConsole GetEnvironmentVariableW CloseHandle GetLastError CreateProcessW GetModuleFileNameW RtlUnwind LoadResource LockResource SizeofResource FindResourceW MoveFileExW GetModuleHandleW GetProcAddress LoadLibraryExW CreateFileW ReadFile WriteFile GetOverlappedResult CancelIoEx SetEvent ResetEvent WaitForSingleObject CreateEventW CreateThread WideCharToMultiByte GetWindowsDirectoryA GetCurrentProcess GetLocaleInfoEx VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA LoadLibraryA MultiByteToWideChar GetLocaleInfoA

cabinet

ord40 ord43 ord45

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_cede57be207e64e4559b29e7b2f8d446_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3d12

d3d11

dxgi

d3dcompiler_47

gdi32

user32

shell32

imm32

xinput1_4

hid

setupapi

winmm

ole32

shlwapi

ws2_32

dbghelp

winhttp

bcrypt

crypt32

kernel32

cabinet

generic