2026-11-11_25a45d159281b2284bdd807fcc8dad82_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_25a45d159281b2284bdd807fcc8dad82_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.8MB
Sample261113-s2hd3sxt9m
SHA256 f9a5b846e571b96f3fa227b3c6f73633fb02ccf59e01386793b97abab7d2bc6d
MD5 25a45d159281b2284bdd807fcc8dad82
SHA1 fc03227c56b466de82b1cd5d775b5a1b5375cb54
SHA512 3fff6cfdb467b1a1da74ca7b141d9116afd2bff3d202a10a12d69f64f237109abd49ace23f8cd895dbe96312e7e2f4d7c8fa61b6aa44b1da93ccd94f8039ccec
SSDEEP 49152:8RW+xQ9nRUgLckbVf1TbUe5O7/PJUk2dwixVnP3:viLQEKdw8
TLSH
T195D59D26B5A441ECD076C078CE5BA91BE7713449073069EB33E44B5E2F736E44ABFA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_25a45d159281b2284bdd807fcc8dad82_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-11-11_25a45d159281b2284bdd807fcc8dad82_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.8MB

2026-11-11_25a45d159281b2284bdd807fcc8dad82_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 8c42f8acbc61bef3942723bf673beee0
SHA256 f9a5b846e571b96f3fa227b3c6f73633fb02ccf59e01386793b97abab7d2bc6d
MD5 25a45d159281b2284bdd807fcc8dad82
SHA1 fc03227c56b466de82b1cd5d775b5a1b5375cb54
SHA512 3fff6cfdb467b1a1da74ca7b141d9116afd2bff3d202a10a12d69f64f237109abd49ace23f8cd895dbe96312e7e2f4d7c8fa61b6aa44b1da93ccd94f8039ccec
SSDEEP 49152:8RW+xQ9nRUgLckbVf1TbUe5O7/PJUk2dwixVnP3:viLQEKdw8
TLSH
T195D59D26B5A441ECD076C078CE5BA91BE7713449073069EB33E44B5E2F736E44ABFA12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sikor\Desktop\dobre jest\cs2-esp\src\loader\bin\Oasis\cs2_injector.pdb

gdiplus

GdipFree GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillPath GdipFillRectangle GdipGraphicsClear GdipScaleWorldTransform GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipAlloc

shell32

ShellExecuteW ShellExecuteExW

dwmapi

DwmSetWindowAttribute

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileType CreateFileW GetFileSize ReadFile CloseHandle Sleep GetCurrentProcess GetModuleFileNameW MulDiv DeleteFileW WriteFile GetTempPathW GetLastError SetLastError WaitForSingleObject OpenEventW GetCurrentProcessId CreateRemoteThread GetExitCodeThread FlushInstructionCache OpenProcess GetTickCount64 GetProcessHeap VirtualProtectEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryA LocalFree FormatMessageW MoveFileExW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle LCMapStringW TerminateProcess ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP HeapSize GetConsoleMode HeapReAlloc WriteConsoleW VirtualAllocEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc

user32

GetWindowTextLengthW IsWindowVisible SetProcessDpiAwarenessContext GetDpiForSystem LoadIconW LoadCursorW SetCursor AdjustWindowRectEx GetClientRect InvalidateRect GetWindowThreadProcessId UpdateWindow GetSystemMetrics ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent GetWindow EnumWindows EndPaint BeginPaint

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

advapi32

AdjustTokenPrivileges GetTokenInformation OpenProcessToken LookupPrivilegeValueW

Name

.text

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_25a45d159281b2284bdd807fcc8dad82_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

gdiplus

shell32

dwmapi

kernel32

user32

gdi32

advapi32

generic