2026-08-20_9aa19531d2491d0708e2ca9b034de99b_cobalt-strike_glassworm

General

Target
2026-08-20_9aa19531d2491d0708e2ca9b034de99b_cobalt-strike_glassworm
Size 3.6MB
Sample260820-3rbhws1vhs
SHA256 493e5ce9e0abfde48ffe5a3cfac93c401eecac559d5c9f7bf77295592f86cba5
MD5 9aa19531d2491d0708e2ca9b034de99b
SHA1 7c4dd7c1f1ac273f6ab36d0c48cf18b853f114da
SHA512 c365a8d93a46c25b3355ee40bb7f725bbb2eeeb8cdae5ab2d2fc864d66be8d8234b568164fd28aae5b7ef79f349e65082e00b852a33beb9a6eab671c73160043
SSDEEP 24576:Fuh4Q/x/X9VRIpuF3jodaFUwVtGihGD6zOPDnm1WFvU1WwS:k/RIpc3joaFUwC7kEvU1WwS
TLSH
T11206C8B665907572D1EBE934C932C2226832F4397B7117E79D8436A89E3C5C02DBEB70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_9aa19531d2491d0708e2ca9b034de99b_cobalt-strike_glassworm

File Explorer

2026-08-20_9aa19531d2491d0708e2ca9b034de99b_cobalt-strike_glassworm

.exe 3.6MB

2026-08-20_9aa19531d2491d0708e2ca9b034de99b_cobalt-strike_glassworm

IMPHASH 74818b63731f2511d9835317a87a26b1
SHA256 493e5ce9e0abfde48ffe5a3cfac93c401eecac559d5c9f7bf77295592f86cba5
MD5 9aa19531d2491d0708e2ca9b034de99b
SHA1 7c4dd7c1f1ac273f6ab36d0c48cf18b853f114da
SHA512 c365a8d93a46c25b3355ee40bb7f725bbb2eeeb8cdae5ab2d2fc864d66be8d8234b568164fd28aae5b7ef79f349e65082e00b852a33beb9a6eab671c73160043
SSDEEP 24576:Fuh4Q/x/X9VRIpuF3jodaFUwVtGihGD6zOPDnm1WFvU1WwS:k/RIpc3joaFUwC7kEvU1WwS
TLSH
T11206C8B665907572D1EBE934C932C2226832F4397B7117E79D8436A89E3C5C02DBEB70
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

689952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

msvcrt

_beginthread memcpy malloc fwrite free fprintf exit abort _errno __iob_func

kernel32

WaitForSingleObject SetEvent CreateEventA WriteFile VirtualQuery VirtualProtect VirtualFree VirtualAlloc TerminateProcess Sleep ReleaseSRWLockExclusive ReadFile QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringA LeaveCriticalSection K32GetProcessMemoryInfo IsDebuggerPresent InitializeCriticalSection GetSystemInfo GetStdHandle GetProcessId GetNativeSystemInfo GetLastError GetFileAttributesA GetEnvironmentVariableA GetCurrentThreadId GetCurrentProcess EnterCriticalSection CreateFileA CloseHandle AcquireSRWLockExclusive WriteFile WriteConsoleW WaitForMultipleObjects WaitForSingleObject VirtualQuery VirtualFree VirtualAlloc SwitchToThread SuspendThread Sleep SetWaitableTimer SetUnhandledExceptionFilter SetProcessPriorityBoost SetEvent SetErrorMode SetConsoleCtrlHandler ResumeThread PostQueuedCompletionStatus LoadLibraryA LoadLibraryW SetThreadContext GetThreadContext GetSystemInfo GetSystemDirectoryA GetStdHandle GetQueuedCompletionStatusEx GetProcessAffinityMask GetProcAddress GetEnvironmentStringsW GetConsoleMode FreeEnvironmentStringsW ExitProcess DuplicateHandle CreateWaitableTimerExW CreateThread CreateIoCompletionPort CreateEventA CloseHandle AddVectoredExceptionHandler

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

110KB

Virtual Size

10.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_9aa19531d2491d0708e2ca9b034de99b_cobalt-strike_glassworm

msvcrt

kernel32

generic