2026-01-16_584748b4f4243349f9839b1eb577a6d3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-16_584748b4f4243349f9839b1eb577a6d3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 3.5MB
Sample261113-ndeaasax3t
SHA256 a935e0eec1ec28fd7be67b46ad8c2034dc1446e8d0f20b35eba7b35e224a820f
MD5 9f64052b4f37817dfd3ec7a1778161e2
SHA1 d01f51c70539b9b34b98168492dd579c9819c69d
SHA512 f50987184e3bc859d22299e68a073650e94b298614db89fff51a36ea714e9c5d40203cf6700b0182829fdffccd53f679f4ac9fc2cbab66bd2bedc3e0b9c13af0
SSDEEP 49152:mLT31iAVS5qQ5JnAPqUs5XjPo/iwEkoT5KzFUZGSFwZMuA+DbvtffpLNiXicJFFS:2iLFGSeFJB7wRGpj3
TLSH
T147F5280272E90789F6F78778C936A2129476BC2D9B12D7EF1654014E1F23BE48979B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-01-16_584748b4f4243349f9839b1eb577a6d3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

File Explorer

2026-01-16_584748b4f4243349f9839b1eb577a6d3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

.exe 3.5MB

2026-01-16_584748b4f4243349f9839b1eb577a6d3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

IMPHASH 9fed93abb265fdd3beaa711f74a32268
SHA256 a935e0eec1ec28fd7be67b46ad8c2034dc1446e8d0f20b35eba7b35e224a820f
MD5 9f64052b4f37817dfd3ec7a1778161e2
SHA1 d01f51c70539b9b34b98168492dd579c9819c69d
SHA512 f50987184e3bc859d22299e68a073650e94b298614db89fff51a36ea714e9c5d40203cf6700b0182829fdffccd53f679f4ac9fc2cbab66bd2bedc3e0b9c13af0
SSDEEP 49152:mLT31iAVS5qQ5JnAPqUs5XjPo/iwEkoT5KzFUZGSFwZMuA+DbvtffpLNiXicJFFS:2iLFGSeFJB7wRGpj3
TLSH
T147F5280272E90789F6F78778C936A2129476BC2D9B12D7EF1654014E1F23BE48979B33
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1302304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

C:\jenkins\workspace\dptf\Src\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\ipf_uf.pdb

kernel32

GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetSystemPowerStatus WideCharToMultiByte GetTimeZoneInformation GetFileAttributesExW GetFileSizeEx SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode SetStdHandle GetCurrentDirectoryW GetOEMCP GetThreadId GetCurrentThreadId SetCurrentDirectoryW GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler RaiseException GetStringTypeW HeapReAlloc MoveFileExW EnumSystemLocalesW CreateFileA DeviceIoControl GetUserDefaultLCID GetEnvironmentVariableA GetTempPathW GetTempPathA SetLastError CreateMutexA SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW HeapSize OpenProcess SetEndOfFile GetTickCount64 CreateMutexW ReleaseMutex OutputDebugStringA WaitForMultipleObjects FormatMessageA WriteConsoleW LoadLibraryExW IsValidLocale GetLocaleInfoW TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetStdHandle GetCommandLineW GetExitCodeProcess ExitThread GetExitCodeThread CreateProcessW AddDllDirectory SetDllDirectoryW WriteConsoleInputW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult LocalFree CloseHandle LoadLibraryExA GetProcAddress GetModuleHandleExA FreeLibrary GetLastError AcquireSRWLockShared ReleaseSRWLockShared GetFileAttributesA LocalAlloc FindNextFileA FindFirstFileA FindClose QueryPerformanceFrequency QueryPerformanceCounter CreateThread WTSGetActiveConsoleSessionId TlsFree TlsSetValue CreateDirectoryW RemoveDirectoryW CopyFileW GetCurrentProcess CreateSemaphoreW Sleep CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock DuplicateHandle TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount OutputDebugStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetFileAttributesW GetModuleHandleW VerifyVersionInfoW VerSetConditionMask GetFullPathNameW CreateProcessA MultiByteToWideChar GetCurrentThread HeapAlloc HeapFree GetCommandLineA ExitProcess FileTimeToSystemTime DeleteFileW SystemTimeToTzSpecificLocalTime PeekNamedPipe RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent __C_specific_handler WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DeleteCriticalSection GetDriveTypeW GetFileInformationByHandle GetFileType RtlUnwind

powrprof

PowerRemovePowerSetting PowerReadACValueIndex PowerReadDCValueIndex CallNtPowerInformation PowerWriteSettingAttributes SetSuspendState

ole32

CoDecrementMTAUsage CoIncrementMTAUsage CoInitializeEx StringFromCLSID CoTaskMemFree CoCreateInstance PropVariantClear CoUninitialize CoCreateGuid StringFromGUID2

api-ms-win-core-winrt-string-l1-1-0

WindowsCompareStringOrdinal WindowsCreateString WindowsCreateStringReference WindowsDuplicateString WindowsDeleteString WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

setupapi

CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Get_DevNode_Registry_PropertyW CM_Get_Parent CM_Get_Sibling CM_Locate_DevNodeW CM_Get_Child

api-ms-win-power-setting-l1-1-0

PowerWriteDCValueIndex PowerWriteACValueIndex PowerSettingUnregisterNotification PowerSettingRegisterNotification PowerSetActiveScheme PowerGetActiveScheme

advapi32

AddAccessAllowedAce StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W DuplicateTokenEx CreateProcessAsUserW ConvertStringSidToSidW ConvertSidToStringSidA GetUserNameA LookupAccountNameA SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce OpenProcessToken RegGetValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteKeyExW RegCreateKeyExW RegCloseKey EventUnregister CloseTrace ProcessTrace OpenTraceW EnableTraceEx ControlTraceW StartTraceW EventWriteString EventProviderEnabled EventWrite EventRegister

tdh

TdhGetEventInformation TdhGetProperty TdhGetPropertySize

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ctlAUXAccess ctlCheckDriverVersion ctlClose ctlEngineGetActivity ctlEngineGetProperties ctlEnumEngineGroups ctlEnumFans ctlEnumFrequencyDomains ctlEnumMemoryModules ctlEnumPowerDomains ctlEnumTemperatureSensors ctlEnumerateDevices ctlEnumerateDisplayOutputs ctlEnumerateMuxDevices ctlFanGetConfig ctlFanGetProperties ctlFanGetState ctlFanSetDefaultMode ctlFanSetFixedSpeedMode ctlFanSetSpeedTableMode ctlFrequencyGetAvailableClocks ctlFrequencyGetProperties ctlFrequencyGetRange ctlFrequencyGetState ctlFrequencyGetThrottleTime ctlFrequencySetRange ctlGetAdaperDisplayEncoderProperties ctlGetBrightnessSetting ctlGetCurrentScaling ctlGetCurrentSharpness ctlGetDeviceProperties ctlGetDisplayProperties ctlGetIntelArcSyncInfoForMonitor ctlGetIntelArcSyncProfile ctlGetLACEConfig ctlGetMuxProperties ctlGetPowerOptimizationCaps ctlGetPowerOptimizationSetting ctlGetSet3DFeature ctlGetSetRetroScaling ctlGetSetVideoProcessingFeature ctlGetSharpnessCaps ctlGetSupported3DCapabilities ctlGetSupportedRetroScalingCapability ctlGetSupportedScalingCapability ctlGetSupportedVideoProcessingCapabilities ctlGetZeDevice ctlI2CAccess ctlInit ctlMemoryGetBandwidth ctlMemoryGetProperties ctlMemoryGetState ctlOverclockGetProperties ctlOverclockGpuFrequencyOffsetGet ctlOverclockGpuFrequencyOffsetSet ctlOverclockGpuLockGet ctlOverclockGpuLockSet ctlOverclockGpuVoltageOffsetGet ctlOverclockGpuVoltageOffsetSet ctlOverclockPowerLimitGet ctlOverclockPowerLimitSet ctlOverclockTemperatureLimitGet ctlOverclockTemperatureLimitSet ctlOverclockVramFrequencyOffsetGet ctlOverclockVramFrequencyOffsetSet ctlOverclockVramVoltageOffsetGet ctlOverclockVramVoltageOffsetSet ctlOverclockWaiverSet ctlPanelDescriptorAccess ctlPciGetProperties ctlPciGetState ctlPixelTransformationGetConfig ctlPixelTransformationSetConfig ctlPowerGetEnergyCounter ctlPowerGetLimits ctlPowerGetProperties ctlPowerSetLimits ctlPowerTelemetryGet ctlReservedCall ctlSetBrightnessSetting ctlSetCurrentScaling ctlSetCurrentSharpness ctlSetIntelArcSyncProfile ctlSetLACEConfig ctlSetPowerOptimizationSetting ctlSetRuntimePath ctlSoftwarePSR ctlSwitchMux ctlTemperatureGetProperties ctlTemperatureGetState ctlWaitForPropertyChange

Name

.textX

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

Name

.rdataX

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dataX

Size

86KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdataX

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

minATLX

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATAX

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrcX

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.relocX

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=11, id=259, version=27412,

count=201, id=261, version=27412,

count=15, id=260, version=27412,

count=46, id=261, version=28920,

count=18, id=260, version=28920,

count=9, id=259, version=28920,

count=1, id=263, version=27412,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=262, id=1, productName=Unmarked objects,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=13, id=261, productName=VS2019 v16.7.0 build 29110, version=29110,

count=70, id=260, productName=VS2019 v16.7.0 build 29110, version=29110,

count=1, id=256, productName=VS2019 v16.7.0 build 29110, version=29110,

count=1, id=255, productName=VS2019 v16.7.0 build 29110, version=29110,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.7.0 build 29110, version=29110,