2026-08-20_ba2eda1d71aa2aa7a6aaa35e96f5d43f_cobalt-strike_gazer_glassworm_helldown_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_ba2eda1d71aa2aa7a6aaa35e96f5d43f_cobalt-strike_gazer_glassworm_helldown_satacom_vidar
Size 1.6MB
Sample260820-xhzapstdpe
SHA256 fb774d85cdf3ceadef6dd2abdceba974c98eea06922213777c48a15b8bd6a94c
MD5 ba2eda1d71aa2aa7a6aaa35e96f5d43f
SHA1 4556ccff21164ed50711d776df9e3a9fb9257263
SHA512 b5a46667d0f6df997937448a79f3e3a7a6315ebcd20505bc2aeb1dbcf028aec5e98868b3a28cff616ee9a64e02e84c17fe8b4e579c67fb176dd2837b81359cca
SSDEEP 24576:dYTmPUqMmMCsmsasmsCMmMKsmsCMmMaMmMCsmswVMmMCsmsasmsCMmMKsmsCMmMI:u1KlUpSmzuc0J0
TLSH
T1B5856947525C42EBC55AD178CE375617A6F3BC38535CAFDBCA908CA42E23AE1C93B214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_ba2eda1d71aa2aa7a6aaa35e96f5d43f_cobalt-strike_gazer_glassworm_helldown_satacom_vidar

File Explorer

2026-08-20_ba2eda1d71aa2aa7a6aaa35e96f5d43f_cobalt-strike_gazer_glassworm_helldown_satacom_vidar

.exe 1.6MB

2026-08-20_ba2eda1d71aa2aa7a6aaa35e96f5d43f_cobalt-strike_gazer_glassworm_helldown_satacom_vidar

IMPHASH 60b04a59e2041d618589ffdcda56d9dd
SHA256 fb774d85cdf3ceadef6dd2abdceba974c98eea06922213777c48a15b8bd6a94c
MD5 ba2eda1d71aa2aa7a6aaa35e96f5d43f
SHA1 4556ccff21164ed50711d776df9e3a9fb9257263
SHA512 b5a46667d0f6df997937448a79f3e3a7a6315ebcd20505bc2aeb1dbcf028aec5e98868b3a28cff616ee9a64e02e84c17fe8b4e579c67fb176dd2837b81359cca
SSDEEP 24576:dYTmPUqMmMCsmsasmsCMmMKsmsCMmMaMmMCsmswVMmMCsmsasmsCMmMKsmsCMmMI:u1KlUpSmzuc0J0
TLSH
T1B5856947525C42EBC55AD178CE375617A6F3BC38535CAFDBCA908CA42E23AE1C93B214
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1473900

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\jbala\Desktop\v\00winupdater.pdb

kernel32

GetLastError AddVectoredExceptionHandler CreatePipe QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock WaitForSingleObject GetCurrentProcess GetExitCodeProcess CreateThread CreateProcessW GetSystemTimeAsFileTime GetNativeSystemInfo VirtualAlloc VirtualProtect LocalAlloc LocalFree FormatMessageW CopyFileW CloseHandle FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte GetConsoleOutputCP GetConsoleMode SetConsoleMode SetConsoleOutputCP GetConsoleWindow GetCurrentThreadId GetCurrentProcessId GetModuleHandleW ReadFile GetLongPathNameW GetFullPathNameW GetFinalPathNameByHandleW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead SetHandleInformation GetFileAttributesW CreateFileW CreateDirectoryW ExpandEnvironmentStringsW GetStdHandle SystemTimeToTzSpecificLocalTime RtlCaptureStackBackTrace

user32

ShowWindow wsprintfW

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext

ws2_32

WSAConnectByNameW WSAStartup socket shutdown setsockopt sendto getaddrinfo freeaddrinfo connect closesocket __WSAFDIsSet WSAGetLastError getpeername getsockname recv select send inet_ntop

dbghelp

SymGetLineFromAddr64 SymCleanup SymSetOptions SymInitialize SymFromAddr

crypt32

CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenSystemStoreW CertFindChainInStore CertFreeCertificateChain CertCloseStore CertFreeCertificateContext

secur32

InitSecurityInterfaceW

vcruntime140

strstr __current_exception_context __C_specific_handler strchr memset memmove memcpy memcmp __current_exception

api-ms-win-crt-runtime-l1-1-0

signal _register_thread_local_exe_atexit_callback _c_exit strerror __p___argc exit _exit _errno terminate _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _configure_wide_argv __p___wargv _set_app_type

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf _wfopen __acrt_iob_func __stdio_common_vsprintf _set_fmode ftell fclose feof _get_osfhandle __stdio_common_vfprintf __p__commode setbuf fseek fwrite _fseeki64 fread _fileno fflush ferror fopen

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc realloc free

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-convert-l1-1-0

_itoa

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_ba2eda1d71aa2aa7a6aaa35e96f5d43f_cobalt-strike_gazer_glassworm_helldown_satacom_vidar

kernel32

user32

advapi32

ws2_32

dbghelp

crypt32

secur32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic