2026-08-04_163eed35cc1e1c778e5af2da87885cd7_cobalt-strike_glassworm_petya_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_163eed35cc1e1c778e5af2da87885cd7_cobalt-strike_glassworm_petya_satacom
Size 2.4MB
Sample260804-3cb6wazzhv
SHA256 1466cdd2993b271708aaa015d1e924cc8053990de466aea1472efde935b1c9fc
MD5 163eed35cc1e1c778e5af2da87885cd7
SHA1 a2468bfa0d4b4cd6b3b61f75f8302fa1cd3463ab
SHA512 47c6961b7721f1445bbded857460046ce24241afa1e6a0bbc2c41f871a8f3f05452c1f52059080225d436ddffb311b5a827f4c30d19a7cb7bc28bac7ef7012ab
SSDEEP 49152:VqzoGWch0UuhV+3Q5rEFgtDTBT8+HER/ZccZqDTNFapl:VqEFEFEmqDTNApl
TLSH
T153C5DF46E3A402ADC5A7D13CCA839713EB737858073096DB67A08AA95F637F05E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_USNDeleteJournal

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_163eed35cc1e1c778e5af2da87885cd7_cobalt-strike_glassworm_petya_satacom

File Explorer

2026-08-04_163eed35cc1e1c778e5af2da87885cd7_cobalt-strike_glassworm_petya_satacom

.exe 2.4MB

2026-08-04_163eed35cc1e1c778e5af2da87885cd7_cobalt-strike_glassworm_petya_satacom

IMPHASH 90e629dd4aa25312f80e1f6dabcb63e2
SHA256 1466cdd2993b271708aaa015d1e924cc8053990de466aea1472efde935b1c9fc
MD5 163eed35cc1e1c778e5af2da87885cd7
SHA1 a2468bfa0d4b4cd6b3b61f75f8302fa1cd3463ab
SHA512 47c6961b7721f1445bbded857460046ce24241afa1e6a0bbc2c41f871a8f3f05452c1f52059080225d436ddffb311b5a827f4c30d19a7cb7bc28bac7ef7012ab
SSDEEP 49152:VqzoGWch0UuhV+3Q5rEFgtDTBT8+HER/ZccZqDTNFapl:VqEFEFEmqDTNApl
TLSH
T153C5DF46E3A402ADC5A7D13CCA839713EB737858073096DB67A08AA95F637F05E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1053520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mechu\Desktop\kot\out\nowy.pdb

d3dx9_43

D3DXMatrixTranspose D3DXVec3Transform D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

kernel32

OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent GetEnvironmentVariableW LocalAlloc SetFileInformationByHandle GetSystemInfo LocalFree GetModuleHandleW VirtualQueryEx AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileSizeEx CreateFileA GetTickCount SetLastError WaitForMultipleObjects PeekNamedPipe ReadFile GetFileType GetStdHandle VirtualProtect WaitForSingleObjectEx MoveFileExA VerifyVersionInfoA GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx GetLocaleInfoEx WakeAllConditionVariable SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc WriteProcessMemory CreateRemoteThreadEx CreateRemoteThread VirtualAllocEx DuplicateHandle GetProcessId TerminateProcess FormatMessageA VirtualAlloc MultiByteToWideChar GetExitCodeProcess LoadLibraryA GetLastError GetModuleHandleA GetCurrentProcess GetStartupInfoW GetDriveTypeW FreeLibrary CreateProcessW GetCurrentProcessId ExitProcess GetProcAddress CreateThread QueryPerformanceCounter VerSetConditionMask GetEnvironmentVariableA QueryPerformanceFrequency LoadLibraryW Process32FirstW DeleteFileW Process32NextW GetTickCount64 GetLogicalDriveStringsW SetFileAttributesW CreateFileW WaitForSingleObject FindClose GetTempPathW GetModuleFileNameW DeviceIoControl FindNextFileW FindFirstFileW ReadProcessMemory VirtualProtectEx CloseHandle Process32Next K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess Module32First Module32Next Process32First Sleep SleepConditionVariableSRW GetCurrentThreadId GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW CreateFile2 AreFileApisANSI

user32

UnhookWindowsHookEx DefWindowProcA SetLayeredWindowAttributes SetCursorPos TranslateMessage FindWindowW PeekMessageA PostQuitMessage UpdateWindow OpenClipboard CallNextHookEx CreateWindowExW PostMessageA SetWindowPos DestroyWindow SendMessageTimeoutW SetWindowsHookExA RegisterClassExW SetWindowLongA GetWindowRect IsWindowVisible GetSystemMetrics GetWindowTextA GetWindowLongA MoveWindow EnumWindows SetWindowsHookA LoadIconA GetWindowLongPtrA GetWindowTextLengthA CloseClipboard EmptyClipboard SetWindowDisplayAffinity ShowCursor mouse_event DispatchMessageA ShowWindow ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient SetClipboardData GetClipboardData UnregisterClassW GetForegroundWindow GetAsyncKeyState FindWindowA GetKeyState GetMessageExtraInfo LoadCursorA GetCursorPos

advapi32

RegEnumKeyExW CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData SetSecurityDescriptorDacl RegGetKeySecurity RegQueryInfoKeyW AllocateAndInitializeSid SetEntriesInAclW RegSetKeySecurity FreeSid InitializeSecurityDescriptor RegCreateKeyExW RegSetValueExW RegGetValueA RegCloseKey CloseServiceHandle OpenSCManagerW RegDeleteKeyW ControlService CryptDestroyHash RegDeleteTreeW RegOpenKeyExW RegDeleteValueW OpenServiceW RegEnumValueW AdjustTokenPrivileges OpenProcessToken GetTokenInformation CryptDestroyKey CryptImportKey CryptEncrypt CryptAcquireContextA

shell32

SHGetFolderPathW SHChangeNotify

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ _Query_perf_counter ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?uncaught_exceptions@std@@YAHXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bios_base@std@@QEBA_NXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Strxfrm ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z __crtLCMapStringA __crtLCMapStringW _Query_perf_frequency ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ

ws2_32

gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError closesocket socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError send recv ntohl

normaliz

IdnToAscii

crypt32

CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertFindExtension CertFreeCertificateChain CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertOpenStore CertGetCertificateChain CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertAddCertificateContextToStore

wldap32

ord50 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord45 ord41 ord60 ord211 ord46 ord217 ord143 ord301

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

wevtapi

EvtOpenChannelEnum EvtOpenLog EvtClose EvtNextChannelPath EvtClearLog

iphlpapi

GetIpAddrTable

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpReadData WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpOpen

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memchr memcmp memmove strrchr memset memcpy __RTtypeid __std_type_info_compare strchr strstr wcsstr __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

calloc realloc free _set_new_mode malloc _callnewh

api-ms-win-crt-string-l1-1-0

wcscpy_s _stricmp towlower strncmp toupper tolower towupper wcsncmp _wcsicmp _strdup strcpy_s strncpy strpbrk isupper strspn strcspn strcmp wcsncpy_s strlen wcslen isalnum

api-ms-win-crt-stdio-l1-1-0

fopen fputs _get_stream_buffer_pointers _open fgets _wfopen _close _write _fseeki64 fread fsetpos ungetc setvbuf fgetpos fseek fwrite __acrt_iob_func _read fgetc __stdio_common_vsscanf ftell __p__commode fflush feof __stdio_common_vswprintf_s fputc _lseeki64 _set_fmode __stdio_common_vsprintf_s __stdio_common_vsprintf fopen_s __stdio_common_vfprintf fclose

api-ms-win-crt-convert-l1-1-0

strtoll strtoull strtoul mbstowcs atoi atof strtod strtol

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _get_narrow_winmain_command_line _initterm _initterm_e _exit _errno _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table exit _beginthreadex _initialize_narrow_environment _configure_narrow_argv _getpid terminate __sys_nerr abort strerror

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _wsplitpath_s _stat64 _fstat64 _lock_file _access

api-ms-win-crt-math-l1-1-0

sqrtf sqrt _hypotf roundf sinf powf logf pow __setusermatherr acosf atan2f log ceilf fmodf cosf

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_collate_cp_func ___lc_locale_name_func ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_163eed35cc1e1c778e5af2da87885cd7_cobalt-strike_glassworm_petya_satacom

d3dx9_43

d3dx11_43

d3d11

ole32

oleaut32

kernel32

user32

advapi32

shell32

msvcp140

ws2_32

normaliz

crypt32

wldap32

ntdll

wevtapi

iphlpapi

imm32

d3dcompiler_43

dwmapi

winhttp

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

generic