2026-08-16_4dc03849c4c37ef4524f09b7208f3a61_cobalt-strike_glassworm_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_4dc03849c4c37ef4524f09b7208f3a61_cobalt-strike_glassworm_icedid_satacom_stealc
Size 1.8MB
Sample260816-e95bxsdk4v
SHA256 ecae5b505d656324e2e8c8896b9b9c2c8a479b4755f84a1fdbdd71f0e6c4fbb6
MD5 4dc03849c4c37ef4524f09b7208f3a61
SHA1 463c3eebb7a65d67bf1960386439ab2e8827ec8e
SHA512 eefb93d367aa55a63f76e74feeb011d0b7466234369712eee21e6c7d6924a215befc495d4015813cca2bdef98c1d46ad9e911d13bfc4a8f127687fbd533370d1
SSDEEP 24576:UcKgLEeW5Aq9JWUeIc7GGfjb0857GGfjb08EeI47GGfjb08geIvB17w:ZBEsgbcT5TEb4TgbvB17w
TLSH
T1D5958D49E14818F1F3A7E0769B6526067C7C3576A7C008CBF6AC490E1FE5ACD217BB29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_4dc03849c4c37ef4524f09b7208f3a61_cobalt-strike_glassworm_icedid_satacom_stealc

File Explorer

2026-08-16_4dc03849c4c37ef4524f09b7208f3a61_cobalt-strike_glassworm_icedid_satacom_stealc

.exe 1.8MB

2026-08-16_4dc03849c4c37ef4524f09b7208f3a61_cobalt-strike_glassworm_icedid_satacom_stealc

IMPHASH 47338618c4769564f2ee5bda82e485b4
SHA256 ecae5b505d656324e2e8c8896b9b9c2c8a479b4755f84a1fdbdd71f0e6c4fbb6
MD5 4dc03849c4c37ef4524f09b7208f3a61
SHA1 463c3eebb7a65d67bf1960386439ab2e8827ec8e
SHA512 eefb93d367aa55a63f76e74feeb011d0b7466234369712eee21e6c7d6924a215befc495d4015813cca2bdef98c1d46ad9e911d13bfc4a8f127687fbd533370d1
SSDEEP 24576:UcKgLEeW5Aq9JWUeIc7GGfjb0857GGfjb08EeI47GGfjb08geIvB17w:ZBEsgbcT5TEb4TgbvB17w
TLSH
T1D5958D49E14818F1F3A7E0769B6526067C7C3576A7C008CBF6AC490E1FE5ACD217BB29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoInitializeEx CoTaskMemFree CoUninitialize

user32

SetWindowPos TranslateMessage LoadCursorW MessageBoxW GetWindowRect GetClientRect GetSystemMetrics ReleaseCapture IsZoomed DispatchMessageW ShowWindow DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW SendMessageW GetMessageW

gdi32

CreateSolidBrush

shell32

SHGetKnownFolderPath ShellExecuteW

shlwapi

ord12

kernel32

IsValidCodePage ReadConsoleW GetACP GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetOEMCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CreateDirectoryW GetFileAttributesW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject GetCurrentProcess ExitProcess GetExitCodeProcess OpenProcess GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLastError GetCurrentThreadId HeapReAlloc EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW LocalFree EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo CreateFileW OutputDebugStringA OutputDebugStringW GetProcAddress GetProcessHeap HeapFree LoadLibraryExW RtlUnwind FindNextFileW FindClose LocalAlloc LoadLibraryW FreeLibrary GetEnvironmentVariableW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLocaleInfoW LCMapStringW FindFirstFileExW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize WriteConsoleW SetEndOfFile FindFirstFileW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent TerminateProcess GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapAlloc VirtualProtect

advapi32

GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister

Name

.text

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_4dc03849c4c37ef4524f09b7208f3a61_cobalt-strike_glassworm_icedid_satacom_stealc

ole32

user32

gdi32

shell32

shlwapi

kernel32

advapi32

generic