2026-11-10_f83337a1babf01bfd904b8975553551e_cobalt-strike_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_f83337a1babf01bfd904b8975553551e_cobalt-strike_glassworm_icedid_njrat_stealc
Size 6.1MB
Sample261110-e6hnrayzdv
SHA256 0bb5f1a2f37b69c6b91b6682abfc5e02409efc360525db7eadce7cd39e7bbafb
MD5 f83337a1babf01bfd904b8975553551e
SHA1 54d54466f46560168dd8e5b9b6092b2c29a21cb5
SHA512 bf606f59e904fc3c5d655f039369db82184f18de771ec9290c64709e9e0fb46d77b8e93b51f6f1dfb3fc8107153bb8d76890eda6b86223a1e738598800559f98
SSDEEP 49152:5Az3NoFFENWte34U/dKQWYfHgOFot0h2lbK62FX47RuxPx3uTMx1rGSHexugffj6:kn34UAQn81IufsMlz/930Hew
TLSH
T10D56AE52A2A840ECC53BD078D65AB60BF771790503349AEB13E05A666F33AF05F7BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-10_f83337a1babf01bfd904b8975553551e_cobalt-strike_glassworm_icedid_njrat_stealc

.exe 6.1MB

2026-11-10_f83337a1babf01bfd904b8975553551e_cobalt-strike_glassworm_icedid_njrat_stealc

IMPHASH 7e00b4c26004fd55ad280fbf2685aaae
SHA256 0bb5f1a2f37b69c6b91b6682abfc5e02409efc360525db7eadce7cd39e7bbafb
MD5 f83337a1babf01bfd904b8975553551e
SHA1 54d54466f46560168dd8e5b9b6092b2c29a21cb5
SHA512 bf606f59e904fc3c5d655f039369db82184f18de771ec9290c64709e9e0fb46d77b8e93b51f6f1dfb3fc8107153bb8d76890eda6b86223a1e738598800559f98
SSDEEP 49152:5Az3NoFFENWte34U/dKQWYfHgOFot0h2lbK62FX47RuxPx3uTMx1rGSHexugffj6:kn34UAQn81IufsMlz/930Hew
TLSH
T10D56AE52A2A840ECC53BD078D65AB60BF771790503349AEB13E05A666F33AF05F7BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

2d:00:2d:c2:6a:13:ee:e1:10:15:13:63:aa:65:c5:07:44:35:15:93:ce:2d:6a:ee:9e:62:6a:3d:e7:38:e0:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 110119,CN=Skutta Software GmbH,O=Skutta Software GmbH,L=Leverkusen,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c054bc3b66c6e,1.3.6.1.4.1.311.60.2.1.2=#13134e6f7264726865696e2d5765737466616c656e,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Nov 6, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

01:f3:b6:a4:0c:6d:73:c8:d7:ca:a0:ef:ae:bf:8a:90

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 14, 2026 - Nov 11, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3389296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wallpaper64.pdb

kernel32

QueryPerformanceCounter ReadFile LocalAlloc CreateNamedPipeW LocalFree CancelSynchronousIo GetStdHandle GetFileType SetStdHandle AttachConsole AllocConsole WriteConsoleW FreeConsole CreateProcessW TerminateProcess WaitForSingleObject SetProcessInformation Sleep IsDebuggerPresent DebugBreak GetVersion WriteFile GetSystemPowerStatus GetWindowsDirectoryW GetLocaleInfoEx GetLocalTime SetThreadErrorMode QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead ConnectNamedPipe GetProcessId GetExitCodeProcess RegisterWaitForSingleObject UnregisterWaitEx FatalAppExitA GetVersionExW SetEvent CreateEventW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetThreadId Process32FirstW Process32NextW ResumeThread QueryFullProcessImageNameW GetCurrentDirectoryW TzSpecificLocalTimeToSystemTime SystemTimeToFileTime VerSetConditionMask InitializeCriticalSection GetFileSize CreateFileMappingA UnmapViewOfFile MapViewOfFile CreateFileA RtlUnwind LoadLibraryExA GetSystemInfo GetFileTime SetEndOfFile HeapQueryInformation HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW AddDllDirectory SetFilePointerEx VerifyVersionInfoW GetConsoleOutputCP FlushFileBuffers OutputDebugStringW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapAlloc HeapFree ExitProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread IsProcessorFeaturePresent GetDriveTypeW FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException RtlPcToFileHeader GetStringTypeW GetSystemTimePreciseAsFileTime GetLogicalProcessorInformationEx GetExitCodeThread WaitForSingleObjectEx WakeConditionVariable TryAcquireSRWLockExclusive CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFile2 DeviceIoControl AreFileApisANSI CreateFile2 WideCharToMultiByte SetFileTime SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW SetPriorityClass Process32Next OpenProcess Process32First CreateToolhelp32Snapshot ReleaseMutex CreateMutexW SetLastError GetLastError SetCurrentDirectoryW SetUnhandledExceptionFilter CloseHandle GetFileSizeEx GetCurrentProcessId FindFirstFileW FindClose CreateDirectoryW FormatMessageA GetCurrentThreadId CreateFileW LoadLibraryExW FormatMessageW GetModuleHandleW VirtualQuery GetLongPathNameW GetModuleFileNameW FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcess MultiByteToWideChar GetConsoleMode

user32

TranslateMessage DispatchMessageW LoadCursorW CreateWindowExW GetMessageW UnregisterClassW SystemParametersInfoW SendMessageTimeoutW FindWindowW RegisterClassW DestroyWindow DefWindowProcW SetTimer SetProcessDefaultLayout MessageBoxW wsprintfW KillTimer SetLayeredWindowAttributes GetWindowThreadProcessId MonitorFromPoint EnumDisplayMonitors EnumDisplayDevicesW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes GetMonitorInfoW SetParent SetWindowsHookExW UnhookWindowsHookEx GetWindowPlacement AdjustWindowRectEx PostThreadMessageW ScreenToClient WindowFromPoint GetKeyState GetParent FillRect ShowCursor RegisterClassExW BringWindowToTop SendMessageW SetActiveWindow LoadIconW ReleaseDC GetClientRect GetDC CloseWindow EnableWindow AttachThreadInput PeekMessageW GetWindowLongPtrW SetWindowPos EndPaint BeginPaint SetWindowLongPtrW UpdateLayeredWindow CallNextHookEx GetAncestor GetForegroundWindow SetWindowLongW EnumWindows LoadStringW GetPropW GetDesktopWindow EnumChildWindows FindWindowExW MonitorFromWindow IsIconic GetWindowLongW SetPropW IsWindowVisible PostQuitMessage DestroyMenu TrackPopupMenu SetForegroundWindow GetCursorPos InsertMenuW InsertMenuItemW CreatePopupMenu SetMenuDefaultItem SetMenuItemInfoW GetMenuItemInfoW GetMenuItemCount GetSubMenu LoadMenuW UnregisterPowerSettingNotification GetWindowRect RegisterPowerSettingNotification ChangeWindowMessageFilter RegisterWindowMessageW GetWindow GetClassNameW PostMessageW LoadImageW GetSystemMetrics DestroyIcon CreateIconIndirect CopyImage GetIconInfo UnregisterHotKey RegisterHotKey UnhookWinEvent SetWinEventHook IsWindow ShowWindow InvalidateRect

gdi32

StretchDIBits GetDIBits BitBlt CreateCompatibleBitmap CreateSolidBrush DeleteDC SelectObject CreateCompatibleDC CreateDIBitmap GetStockObject DeleteObject GetObjectW

shell32

SHGetFolderPathW SetCurrentProcessExplicitAppUserModelID ShellExecuteW Shell_NotifyIconW ShellExecuteExW

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree PropVariantClear StringFromIID IIDFromString

advapi32

RegQueryInfoKeyW RegCloseKey RegSetValueExW RegOpenKeyExW RegEnumKeyExA GetUserNameW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegQueryValueExW RegDeleteValueW RegOpenKeyW RegGetValueA RegGetValueW

d3d11

D3D11CreateDevice

dwmapi

DwmIsCompositionEnabled DwmGetWindowAttribute

winmm

timeEndPeriod timeBeginPeriod

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

shlwapi

ord219

mfreadwrite

MFCreateSourceReaderFromURL MFCreateSourceReaderFromByteStream

dwrite

DWriteCreateFactory

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

914KB

Virtual Size

913KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_f83337a1babf01bfd904b8975553551e_cobalt-strike_glassworm_icedid_njrat_stealc

kernel32

user32

gdi32

shell32

ole32

advapi32

d3d11

dwmapi

winmm

wtsapi32

shlwapi

mfreadwrite

dwrite

generic