2026-09-23_0838c5e13f4e041bba13f12d117febb1_cobalt-strike_glassworm_qilin_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_0838c5e13f4e041bba13f12d117febb1_cobalt-strike_glassworm_qilin_satacom
Size 3.0MB
Sample260925-twprmsvzdy
SHA256 177e8da68a3c6ff64eec072b9ee4df5410e83e3453decb82993398e4b80811c1
MD5 0838c5e13f4e041bba13f12d117febb1
SHA1 4dd03ec8ab2ec90dc04b0b40c4d29a1a2df4ed6a
SHA512 849c9e43df81dbc5444371f8e64c4013f79dcc0372b8ce9c57803afdd702a173d1fbfa0c00a766032b2de9f5db9c596c959df2907f5624dae6de33b42cb0997c
SSDEEP 49152:RJFOU+8+BpXv2GRO/xEkSaasZwiKmtoWxodF7DI14m5qh6Q0CG2gIU6i7Pgikah:RJFIQOqSaawSDIGaQf+7
TLSH
T1DBE57C42F6A680E8D07AC174D35AA233FA72788D47347AFB47D086253E62FD06A3D745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_0838c5e13f4e041bba13f12d117febb1_cobalt-strike_glassworm_qilin_satacom

File Explorer

2026-09-23_0838c5e13f4e041bba13f12d117febb1_cobalt-strike_glassworm_qilin_satacom

.exe 3.0MB

2026-09-23_0838c5e13f4e041bba13f12d117febb1_cobalt-strike_glassworm_qilin_satacom

IMPHASH a426e576a11d3debaf84c0a5bf4b7292
SHA256 177e8da68a3c6ff64eec072b9ee4df5410e83e3453decb82993398e4b80811c1
MD5 0838c5e13f4e041bba13f12d117febb1
SHA1 4dd03ec8ab2ec90dc04b0b40c4d29a1a2df4ed6a
SHA512 849c9e43df81dbc5444371f8e64c4013f79dcc0372b8ce9c57803afdd702a173d1fbfa0c00a766032b2de9f5db9c596c959df2907f5624dae6de33b42cb0997c
SSDEEP 49152:RJFOU+8+BpXv2GRO/xEkSaasZwiKmtoWxodF7DI14m5qh6Q0CG2gIU6i7Pgikah:RJFIQOqSaawSDIGaQf+7
TLSH
T1DBE57C42F6A680E8D07AC174D35AA233FA72788D47347AFB47D086253E62FD06A3D745
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2188272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

WidgetBoard.pdb

kernel32

DeleteFileW CopyFileW ExitProcess GetFileInformationByHandleEx SetFileInformationByHandle SwitchToThread GetCurrentProcessId GetLogicalDriveStringsW GetSystemTimePreciseAsFileTime SearchPathW CreateThread CreateMutexW GetComputerNameW GetSystemInfo HeapReAlloc GetModuleHandleA LoadLibraryA GetProcAddress GetModuleFileNameW CreateProcessW WaitForSingleObject QueryDosDeviceW FindNextFileW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetQueuedCompletionStatusEx SetLastError GetFinalPathNameByHandleW CreateIoCompletionPort SetFileCompletionNotificationModes Sleep GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess GetLastError WaitForSingleObjectEx lstrlenW CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetModuleHandleW FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter SetHandleInformation GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetFileInformationByHandle CreateDirectoryW CreateWaitableTimerExW SetWaitableTimer SetFilePointerEx SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime SetFileAttributesW PostQueuedCompletionStatus CloseHandle FindClose HeapFree RtlLookupFunctionEntry GetProcessHeap InitializeSRWLock TlsAlloc TlsGetValue TlsSetValue InitOnceExecuteOnce AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryW ReleaseSRWLockShared

shell32

ShellExecuteW

urlmon

URLDownloadToFileW

ntdll

RtlNtStatusToDosError NtOpenFile RtlGetCompressionWorkSpaceSize NtCancelIoFileEx RtlDecompressBufferEx NtDeviceIoControlFile NtReadFile NtWriteFile NtCreateFile

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW RegDeleteValueW SystemFunction036 RegSetValueExW

bcryptprimitives

ProcessPrng

ws2_32

WSACleanup WSAStartup getaddrinfo bind freeaddrinfo getsockopt ioctlsocket WSASocketW recv send setsockopt WSAGetLastError connect closesocket WSAIoctl WSASend

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

OpenInputDesktop SetThreadDesktop

bcrypt

BCryptGenRandom

vcruntime140

memmove __CxxFrameHandler3 memchr __C_specific_handler __current_exception memcpy memset __current_exception_context memcmp strchr

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _errno _wassert _initialize_onexit_table _register_onexit_function abort _initialize_narrow_environment _configure_narrow_argv _get_initial_narrow_environment _initterm _crt_atexit _initterm_e exit _set_app_type _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode _setmode fwrite ftell fseek fread _fileno fopen fflush __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fgets ferror feof fclose __acrt_iob_func

api-ms-win-crt-string-l1-1-0

strlen strcmp

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_0838c5e13f4e041bba13f12d117febb1_cobalt-strike_glassworm_qilin_satacom

kernel32

shell32

urlmon

ntdll

advapi32

bcryptprimitives

ws2_32

api-ms-win-core-synch-l1-2-0

user32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic