2026-11-12_41e425a4862728800d6352d954f07654_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_41e425a4862728800d6352d954f07654_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar
Size 1.1MB
Sample261113-e4f25sf17r
SHA256 82b5dae1dbf975a41da477dbfca74a1abfa953bf8094a5aaad933b16277ad871
MD5 41e425a4862728800d6352d954f07654
SHA1 6759f7d1fc8487e1b0afc3c055c0ba3cf83fd1e4
SHA512 1c46e88718d774e9d59db03a7088451062307d01e42416d4dfaf397831f924ac794ef4b008a3b4d1215d9d2c951f36482798b28fda1a5780816448ed054c5dd2
SSDEEP 12288:XY7wFlpSp0ilwEN63wEADrnEC4qS01i+YNnSTbv1o2mpQqq6/6Qfz2fzAR:+wFlaNK0Drnvt1RWSTbtWpDqSz+zAR
TLSH
T1EA356C6A66A800F9D5778039CA56490FE6F27C1513609ADF13A0B76B2F376D81E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-11-12_41e425a4862728800d6352d954f07654_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-11-12_41e425a4862728800d6352d954f07654_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar

.exe 1.1MB

2026-11-12_41e425a4862728800d6352d954f07654_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar

IMPHASH fea18908edd32634329f1c83007a3e90
SHA256 82b5dae1dbf975a41da477dbfca74a1abfa953bf8094a5aaad933b16277ad871
MD5 41e425a4862728800d6352d954f07654
SHA1 6759f7d1fc8487e1b0afc3c055c0ba3cf83fd1e4
SHA512 1c46e88718d774e9d59db03a7088451062307d01e42416d4dfaf397831f924ac794ef4b008a3b4d1215d9d2c951f36482798b28fda1a5780816448ed054c5dd2
SSDEEP 12288:XY7wFlpSp0ilwEN63wEADrnEC4qS01i+YNnSTbv1o2mpQqq6/6Qfz2fzAR:+wFlaNK0Drnvt1RWSTbtWpDqSz+zAR
TLSH
T1EA356C6A66A800F9D5778039CA56490FE6F27C1513609ADF13A0B76B2F376D81E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

fc:6c:ee:1c:42:24:94:1e:76:5d:59:09:c8:16:c1:92:e9:74:9f:a1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

Chains

May 25, 2022

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

266540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildslave\unity\build\artifacts\UnityCrashHandler\Win64_VS2019_nondev_m_r\UnityCrashHandler64.pdb

user32

SetForegroundWindow SetWindowTextW InflateRect UnionRect GetDlgItem LookupIconIdFromDirectoryEx DialogBoxParamA SendDlgItemMessageA GetWindowLongA SetWindowPos EndDialog AdjustWindowRect SendMessageW CreateIconFromResourceEx OffsetRect LoadImageA GetIconInfo

kernel32

InterlockedPopEntrySList DuplicateHandle VirtualProtect GetVersionExW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation SignalObjectAndWait CreateTimerQueue WriteConsoleW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc FreeLibraryAndExitThread GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler GetFileType WaitForSingleObjectEx CloseHandle RaiseException GetLastError GetCurrentThread OpenThread GetThreadTimes GetModuleHandleA GetProcAddress EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority GetThreadPriority RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FreeLibrary GetModuleFileNameA GetModuleFileNameW LoadLibraryA LoadLibraryW MultiByteToWideChar WideCharToMultiByte GetCurrentProcess SuspendThread ResumeThread TlsGetValue TlsSetValue GetThreadContext SetLastError CreateEventW CreateFileW DeleteFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW FlushFileBuffers QueryDepthSList GetFileAttributesA GetFileAttributesW ReadFile SetFilePointerEx WriteFile GetEnvironmentVariableA GetCurrentDirectoryA OutputDebugStringA GetSystemTime ReadProcessMemory VerSetConditionMask GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleW WaitForSingleObject LocalFree FormatMessageW VerifyVersionInfoW CreateToolhelp32Snapshot Thread32First Thread32Next GetStdHandle GetFileSize GetTempPathW SetEvent WaitForMultipleObjectsEx Sleep GetExitCodeProcess CreateProcessW GetProcessId GetThreadId OpenProcess CopyFileExW AllocConsole SetErrorMode GetCommandLineW InitializeCriticalSection CreateEventA TerminateThread GetExitCodeThread LoadLibraryExW LoadResource LockResource SizeofResource EnumResourceNamesA FindResourceA GetFileSizeEx IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency ReleaseSemaphore TlsAlloc TlsFree VirtualAlloc VirtualFree SetStdHandle GetModuleHandleExW ExitProcess InterlockedFlushSList InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx GetLocaleInfoW LCMapStringW CompareStringW GetTickCount GetCPInfo DecodePointer EncodePointer GetStringTypeW InitializeSListHead UnregisterWaitEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent TerminateProcess

dbghelp

SymRegisterFunctionEntryCallback64 SymLoadModuleEx

shell32

CommandLineToArgvW SHCreateDirectoryExW

ole32

CoCreateGuid CoTaskMemFree CoInitializeEx

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

InternetCrackUrlA HttpQueryInfoA HttpOpenRequestA InternetConnectA InternetCloseHandle HttpSendRequestA InternetOpenA

gdi32

GetObjectA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

Name

.text

Size

545KB

Virtual Size

544KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

349KB

Virtual Size

349KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_41e425a4862728800d6352d954f07654_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_stealc_vidar

user32

kernel32

dbghelp

shell32

ole32

psapi

advapi32

wininet

gdi32

version

generic