2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom
Size 8.5MB
Sample260802-klez1syfqa
SHA256 d43bff29522e56c73cbeb4b8e7580556802b1f755f263b6dfc62ee06a5b760ec
MD5 57ef08b79149d17d58fae30107579d1e
SHA1 c6fdb885b91f60487040af030273ba9f4f318610
SHA512 e13005cb7267cdf078a318a1cbc2ec16e2c25ba0b682e0851ff852e7813e96ecbc3a19e9fc8a5947097196e4b3cb4410360331f9a056f382dbd59e35653ed400
SSDEEP 196608:ozAmx3PqB5o7QQLDebroj9HTlaFb53EjCetR0FMhqSXQsdQ1N:2x3Uo7QHetR0FMhqSXQsuz
TLSH
T10B969D147B840EF2E137D175CAA44233D7307885B6258D2B49D4EB490E3BEE14E6EA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom

.exe 8.5MB

2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom

IMPHASH 3cee4427491473f6e21eeb7817ab513c
SHA256 d43bff29522e56c73cbeb4b8e7580556802b1f755f263b6dfc62ee06a5b760ec
MD5 57ef08b79149d17d58fae30107579d1e
SHA1 c6fdb885b91f60487040af030273ba9f4f318610
SHA512 e13005cb7267cdf078a318a1cbc2ec16e2c25ba0b682e0851ff852e7813e96ecbc3a19e9fc8a5947097196e4b3cb4410360331f9a056f382dbd59e35653ed400
SSDEEP 196608:ozAmx3PqB5o7QQLDebroj9HTlaFb53EjCetR0FMhqSXQsdQ1N:2x3Uo7QHetR0FMhqSXQsuz
TLSH
T10B969D147B840EF2E137D175CAA44233D7307885B6258D2B49D4EB490E3BEE14E6EA9F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

6e:83:b5:4b:75:fe:47:5e:a5:31:f0:4b:49:4d:90:b0:39:f5:a8:d8:2f:c3:7b:a3:bd:5f:40:70:bf:74:05:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Dương Công Thuấn,O=Dương Công Thuấn,L=Phung Cong,ST=Hung Yen,C=VN

Chains

Jul 31, 2026

CN=Dương Công Thuấn,O=Dương Công Thuấn,L=Phung Cong,ST=Hung Yen,C=VN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Dương Công Thuấn,O=Dương Công Thuấn,L=Phung Cong,ST=Hung Yen,C=VN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Dương Công Thuấn,O=Dương Công Thuấn,L=Phung Cong,ST=Hung Yen,C=VN

Serial Number

0e:18:ba:7b:61:68:94:95:29:16:05:ce:00:09:a0:87

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2026 - Jul 30, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

3342064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\CPXDVN\cpxd-platform\tools\CPXDWebViewer\CPXDWebViewer\bin\Release\net10.0-windows\win-x64\native\CPXDWebViewer.pdb

advapi32

AddMandatoryAce AdjustTokenPrivileges CreateWellKnownSid DeregisterEventSource EqualSid EventRegister EventUnregister EventWriteString GetAce GetLengthSid GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetWindowsAccountDomainSid ImpersonateLoggedOnUser InitializeAcl InitializeSecurityDescriptor LookupPrivilegeValueW OpenProcessToken OpenThreadToken RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW RevertToSelf SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorSacl

bcrypt

BCryptGetProperty BCryptHashData BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptOpenAlgorithmProvider

kernel32

InitializeCriticalSectionEx EncodePointer FlsFree RtlPcToFileHeader RtlUnwindEx CancelIoEx CancelSynchronousIo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWork CompareStringEx CompareStringOrdinal ConnectNamedPipe CreateDirectoryW CreateEventExW CreateFileW CreateMutexExW CreateNamedPipeW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection EnumCalendarInfoExEx EnumTimeFormatsEx ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNLSStringEx FindStringOrdinal FlushFileBuffers FormatMessageW FreeLibrary GetCalendarInfoEx GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLongPathNameW GetModuleFileNameW GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation GetUserPreferredUILanguages InitializeConditionVariable InitializeCriticalSection IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation LCMapStringEx LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocaleNameToLCID MultiByteToWideChar OpenProcess OpenThread QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ReadFile ResetEvent ResolveLocaleName ResumeThread SetEvent SetFileInformationByHandle SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue WaitForSingleObjectEx CreateEventW SwitchToThread SuspendThread FlushProcessWriteBuffers GetThreadContext SetThreadContext FlushInstructionCache GetSystemTimeAsFileTime VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent SetUnhandledExceptionFilter InitializeSListHead

ole32

CoWaitForMultipleHandles CoUninitialize CoTaskMemFree CoTaskMemAlloc CoGetApartmentType CoInitializeEx CoGetContextToken CoCreateGuid

user32

LoadStringW

version

GetFileVersionInfoExW GetFileVersionInfoSizeExW VerQueryValueW

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _aligned_malloc calloc _aligned_free _callnewh realloc

api-ms-win-crt-math-l1-1-0

modf pow floor cos tan log __setusermatherr sin ceil

api-ms-win-crt-string-l1-1-0

strcmp _stricmp strcpy strncpy_s strcpy_s strlen

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsprintf_s __stdio_common_vfprintf __acrt_iob_func __p__commode __stdio_common_vsnprintf_s _set_fmode

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _initialize_onexit_table abort _register_onexit_function _set_app_type _seh_filter_exe _initterm_e _crt_atexit terminate exit _exit _get_initial_wide_environment _configure_wide_argv _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv __p___argc _initterm

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom

advapi32

bcrypt

kernel32

ole32

user32

version

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic