2026-09-08_092b7d86cc1c6e88cd9270025d43e327_cobalt-strike_glassworm_icedid_satacom_stealc

General

Target
2026-09-08_092b7d86cc1c6e88cd9270025d43e327_cobalt-strike_glassworm_icedid_satacom_stealc
Size 447KB
Sample260910-jksdaasyat
SHA256 9e4258521dbd06e8288365e24d33d2728145515d6ddb92652af28fc5b970cf89
MD5 092b7d86cc1c6e88cd9270025d43e327
SHA1 3a96b8642e54b0f55b31d5477ada688bdbbf46c3
SHA512 e31d07acb1764ff9022876390c74f7c69774e9f58f4edbad3337178d5c84a64613beac22b6e6ddbafa29c0d64c7806e1deafbe352ee0a4f0a9ad147123e73762
SSDEEP 6144:dOo027Kf71wXBg6gfnPu7W31SMI4/wXWL0Ht/jmTq5MWN:CccAWQMIgwnJmTmMY
TLSH
T10AA4081EA6B541F1D0B7D079C642651AFC7138AA8330ABDB5B86DE531F277E0A93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_092b7d86cc1c6e88cd9270025d43e327_cobalt-strike_glassworm_icedid_satacom_stealc

File Explorer

2026-09-08_092b7d86cc1c6e88cd9270025d43e327_cobalt-strike_glassworm_icedid_satacom_stealc

.exe 447KB

2026-09-08_092b7d86cc1c6e88cd9270025d43e327_cobalt-strike_glassworm_icedid_satacom_stealc

IMPHASH 2b355998aa789a6165a2d8b6c563bae7
SHA256 9e4258521dbd06e8288365e24d33d2728145515d6ddb92652af28fc5b970cf89
MD5 092b7d86cc1c6e88cd9270025d43e327
SHA1 3a96b8642e54b0f55b31d5477ada688bdbbf46c3
SHA512 e31d07acb1764ff9022876390c74f7c69774e9f58f4edbad3337178d5c84a64613beac22b6e6ddbafa29c0d64c7806e1deafbe352ee0a4f0a9ad147123e73762
SSDEEP 6144:dOo027Kf71wXBg6gfnPu7W31SMI4/wXWL0Ht/jmTq5MWN:CccAWQMIgwnJmTmMY
TLSH
T10AA4081EA6B541F1D0B7D079C642651AFC7138AA8330ABDB5B86DE531F277E0A93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

170788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptSetProperty BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

crypt32

CryptUnprotectData

kernel32

CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW WriteConsoleW SetEndOfFile GetCurrentProcessId FreeEnvironmentStringsW GetEnvironmentStringsW DecodePointer GetLastError InitializeCriticalSectionEx DeleteCriticalSection GetProcAddress LoadLibraryA LocalFree FormatMessageA GetLocaleInfoEx QueryPerformanceCounter GetSystemTimePreciseAsFileTime CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI CloseHandle GetModuleHandleW CopyFile2 GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException GetOEMCP ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess ExitProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW HeapAlloc VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation HeapReAlloc HeapSize IsValidCodePage GetACP

Name

.text

Size

316KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_092b7d86cc1c6e88cd9270025d43e327_cobalt-strike_glassworm_icedid_satacom_stealc

bcrypt

crypt32

kernel32

generic