2026-11-12_585506b38f02afb0b49cdc0d86b565ba_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_585506b38f02afb0b49cdc0d86b565ba_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.9MB
Sample261113-c2jddaft5p
SHA256 e8102e48885de5813d388a2ce9c150877e52c3cd5441dad4fdc3acf07166e721
MD5 585506b38f02afb0b49cdc0d86b565ba
SHA1 a8d21ae5b246f6cf8f01b872a5feb343de825b7f
SHA512 eccba9db214d35e1904f983bcc6093b3a7f30dae682622916e719be615c5cd999307c007ad253fdb23af492d323931fe150b122fc8e23d141228cf6c2f5d63fb
SSDEEP 49152:qd3+BJTQK5+qYioSNlyKN7Glt9xJ9q0LDDk1:qcBSKpYioQQ1A
TLSH
T1AAE53A4AAA7941E1C0BBD17CC683652BFC7134A68331A7D766859B172F237E4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_585506b38f02afb0b49cdc0d86b565ba_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-11-12_585506b38f02afb0b49cdc0d86b565ba_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.9MB

2026-11-12_585506b38f02afb0b49cdc0d86b565ba_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH e5537f68413cf3558a382aa255c3ac84
SHA256 e8102e48885de5813d388a2ce9c150877e52c3cd5441dad4fdc3acf07166e721
MD5 585506b38f02afb0b49cdc0d86b565ba
SHA1 a8d21ae5b246f6cf8f01b872a5feb343de825b7f
SHA512 eccba9db214d35e1904f983bcc6093b3a7f30dae682622916e719be615c5cd999307c007ad253fdb23af492d323931fe150b122fc8e23d141228cf6c2f5d63fb
SSDEEP 49152:qd3+BJTQK5+qYioSNlyKN7Glt9xJ9q0LDDk1:qcBSKpYioQQ1A
TLSH
T1AAE53A4AAA7941E1C0BBD17CC683652BFC7134A68331A7D766859B172F237E4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1364336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileAttributesA TerminateProcess CreateProcessA OpenProcess GetEnvironmentVariableA GetTempPathA GetCurrentProcessId ExitProcess GetModuleFileNameW QueryFullProcessImageNameA GetComputerNameW DecodePointer HeapAlloc HeapFree GetProcessHeap InitializeCriticalSectionEx Process32First Process32Next MultiByteToWideChar Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateWaitableTimerA SetWaitableTimer CreateEventW SleepEx InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateIoCompletionPort SetLastError WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetModuleFileNameA TerminateThread QueueUserAPC SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect WaitForMultipleObjects CreateEventA CreateMutexA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus GetLastError CloseHandle UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RaiseException WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetTempPathW CreateFile2 AreFileApisANSI DeviceIoControl GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EncodePointer LCMapStringEx GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetCurrentProcess InitializeCriticalSection ResumeThread GetSystemInfo VirtualAllocEx VirtualFreeEx CreateActCtxW WriteFile CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetWindowsDirectoryW GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First ReadFile CreateNamedPipeW CreateThread GetProcessId IsWow64Process WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx LoadLibraryW FreeLibrary SuspendThread GetThreadTimes OpenThread IsDebuggerPresent OutputDebugStringW RtlLookupFunctionEntry RtlUnwindEx RtlUnwind

user32

wsprintfW

advapi32

RegOpenKeyExA AdjustTokenPrivileges OpenProcessToken RegCloseKey RegDeleteValueA RegNotifyChangeKeyValue RegQueryValueExA RegSetValueExA RegCreateKeyExA RegOpenKeyExW OpenThreadToken RegEnumValueW RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyW RegSetValueExW RegQueryValueExW LookupPrivilegeValueW

shell32

ShellExecuteA

ws2_32

ioctlsocket WSAStartup WSACleanup connect closesocket select WSAStringToAddressW getsockopt listen htons htonl bind accept freeaddrinfo getaddrinfo WSASocketW WSASend WSARecv WSAGetLastError WSASetLastError shutdown setsockopt ntohl

bcrypt

BCryptCloseAlgorithmProvider BCryptEncrypt BCryptImportKeyPair BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptGenRandom BCryptFinishHash

wininet

InternetSetOptionA

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty CertAddCertificateContextToStore PFXImportCertStore CertDeleteCertificateFromStore CryptUnprotectData

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpAddRequestHeaders WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts

ole32

CoCreateInstance CoUninitialize CoInitialize

shlwapi

SHDeleteKeyW

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

65KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

124KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_585506b38f02afb0b49cdc0d86b565ba_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ws2_32

bcrypt

wininet

crypt32

winhttp

ole32

shlwapi

oleaut32

generic