2026-09-30_c5bc105fb21d26968ea00c935a014530_cobalt-strike_glassworm_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_c5bc105fb21d26968ea00c935a014530_cobalt-strike_glassworm_icedid_satacom
Size 29.9MB
Sample260930-jtyawsxwcw
SHA256 7a7735bc47d429b7b46eaa625ca17bee465855187bb367971c16f0ef2ca046d0
MD5 c5bc105fb21d26968ea00c935a014530
SHA1 e8bc6e03e2c216b1a60029719a39ee83808c6d4c
SHA512 b9e1e62b34dfd6c1740c9b007bbda43db8db0d9e26a67a0ef14034ac2cafa720baec1990656239edad0c76de74dae1a7a9345408bc2e6c66bd04a1541ba26765
SSDEEP 393216:ExPLjez891e9K8crulzKqjyzIJ+I+H/NotgJ66jUNkQ76X:E8KkK8cylz5jyzIUD/mgJ6RNvk
TLSH
T19F67AF02BA9B98BCE05AC47083464A736E2174DB0B26B9FF51D451393F6EBF05B39718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-30_c5bc105fb21d26968ea00c935a014530_cobalt-strike_glassworm_icedid_satacom

.exe 29.9MB

2026-09-30_c5bc105fb21d26968ea00c935a014530_cobalt-strike_glassworm_icedid_satacom

IMPHASH ddb64ae44c38d5d64f149da8e174ba11
SHA256 7a7735bc47d429b7b46eaa625ca17bee465855187bb367971c16f0ef2ca046d0
MD5 c5bc105fb21d26968ea00c935a014530
SHA1 e8bc6e03e2c216b1a60029719a39ee83808c6d4c
SHA512 b9e1e62b34dfd6c1740c9b007bbda43db8db0d9e26a67a0ef14034ac2cafa720baec1990656239edad0c76de74dae1a7a9345408bc2e6c66bd04a1541ba26765
SSDEEP 393216:ExPLjez891e9K8crulzKqjyzIJ+I+H/NotgJ66jUNkQ76X:E8KkK8cylz5jyzIUD/mgJ6RNvk
TLSH
T19F67AF02BA9B98BCE05AC47083464A736E2174DB0B26B9FF51D451393F6EBF05B39718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

ab:e5:d5:bf:44:10:16:e1:d6:68:91:6b:3d:a6:3d:67:b7:7c:d7:18:97:e2:52:77:13:a0:89:53:68:6c:59:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Yevhen Zelenyi,O=Yevhen Zelenyi,L=Pegnitz,ST=Bayern,C=DE

Chains

Sep 28, 2026

CN=Yevhen Zelenyi,O=Yevhen Zelenyi,L=Pegnitz,ST=Bayern,C=DE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Yevhen Zelenyi,O=Yevhen Zelenyi,L=Pegnitz,ST=Bayern,C=DE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Yevhen Zelenyi,O=Yevhen Zelenyi,L=Pegnitz,ST=Bayern,C=DE

Serial Number

27:8a:73:aa:6d:cd:d5:cd:70:ec:5f:3b:b8:f6:86:8f

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 23, 2026 - Sep 23, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

13394448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fantasy_launcher.pdb

user32

ClipCursor GetClipCursor GetActiveWindow DestroyIcon CreateIcon GetKeyboardState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx AdjustWindowRectEx GetWindowLongW SetWindowLongW EnableMenuItem GetSystemMenu GetWindowRect ShowCursor EmptyClipboard SetClipboardData CloseClipboard IsClipboardFormatAvailable GetClipboardData RegisterClipboardFormatW GetClientRect PostMessageW SetWindowPos InvalidateRgn ReleaseDC DestroyWindow MonitorFromPoint RegisterWindowMessageA LoadCursorW SetCursor GetSystemMetrics PeekMessageW TranslateMessage DispatchMessageW GetWindowLongPtrW GetMonitorInfoW EnumDisplaySettingsExW RedrawWindow SetWindowLongPtrW RegisterRawInputDevices GetForegroundWindow MapVirtualKeyW SendInput SetForegroundWindow MonitorFromWindow SystemParametersInfoW SetProcessDpiAwarenessContext RegisterClassW CreateWindowExW GetDpiForWindow LoadImageW SendMessageW GetDC SetWindowTextW UpdateLayeredWindow DestroyCursor GetKeyState RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware SetWindowDisplayAffinity ShowWindow MessageBoxW PostQuitMessage MsgWaitForMultipleObjectsEx GetRawInputData ValidateRect SystemParametersInfoA IsIconic ScreenToClient ClientToScreen CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture MonitorFromRect OpenClipboard GetMenu ReleaseCapture GetCursorPos SetWindowPlacement ChangeDisplaySettingsExW RegisterClassExW GetClassInfoExW GetWindowPlacement GetClassNameW IsWindowVisible GetWindowThreadProcessId EnumWindows DrawTextW DefWindowProcW

kernel32

IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW UnhandledExceptionFilter VirtualProtect CompareStringW LCMapStringW HeapSize FlsGetValue RemoveDirectoryW LoadLibraryExA FindNextFileW CancelIo QueryPerformanceFrequency GetTempPathW IsThreadAFiber FlsSetValue GetModuleHandleExW FlsAlloc FlsFree GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleFileNameW HeapAlloc GetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx ExitProcess FindFirstFileExW MoveFileExW GetProcessHeap HeapFree HeapReAlloc GetLastError MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetCurrentThread GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear GlobalSize WideCharToMultiByte FormatMessageW GetCurrentThreadId FindClose SwitchToThread CloseHandle OpenProcess WaitForSingleObject GetCurrentProcessId CreateThread GetProcessId FileTimeToLocalFileTime GetModuleHandleW GetVersionExW GetSystemDirectoryW LoadLibraryW GetProcAddress SetFilePointerEx CreatePipe GetCurrentProcess DuplicateHandle GetExitCodeProcess GetProcessTimes TerminateProcess GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleWindow AllocConsole SetConsoleTitleW SetConsoleOutputCP CreateToolhelp32Snapshot Process32FirstW Process32NextW FreeLibrary SetThreadErrorMode LoadLibraryExW CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx SetFileCompletionNotificationModes ReadFile GetOverlappedResult WriteFile CancelIoEx Sleep GetModuleHandleA GetSystemInfo CreateFileW CompareStringOrdinal SleepEx ReadFileEx WriteFileEx SetLastError GetFullPathNameW GetStdHandle CopyFileExW QueryPerformanceCounter SetHandleInformation CreateEventW FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetWindowsDirectoryW CreateProcessW WaitForMultipleObjects CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetCommandLineW lstrlenW

advapi32

GetUserNameW ImpersonateAnonymousToken RevertToSelf RegCloseKey RegSetValueExW RegDeleteValueW RegOpenKeyExW RegCreateKeyExW SystemFunction036 RegQueryValueExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSASend WSAIoctl connect getaddrinfo shutdown WSARecv WSAStartup select bind WSASocketW send recv setsockopt WSADuplicateSocketW getsockname freeaddrinfo WSACleanup WSAGetLastError ioctlsocket closesocket accept getsockopt getpeername listen

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ntdll

NtCancelIoFileEx NtOpenFile NtCreateFile NtDeviceIoControlFile NtCreateNamedPipeFile NtReadFile NtWriteFile RtlNtStatusToDosError

oleaut32

SysFreeString GetErrorInfo SysStringLen

bcryptprimitives

ProcessPrng

shell32

SHCreateItemFromParsingName DragQueryFileW ShellExecuteW DragFinish SHGetKnownFolderPath

gdi32

GetTextExtentPoint32W SetPixelFormat DeleteDC DescribePixelFormat CreateRectRgn GetDeviceCaps DeleteObject SetTextColor SetBkMode CreateFontW SelectObject CreateDIBSection ChoosePixelFormat SwapBuffers CreateCompatibleDC

opengl32

wglShareLists wglCreateContext wglMakeCurrent wglGetProcAddress wglDeleteContext

imm32

ImmAssociateContextEx ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW ImmGetContext

ole32

RevokeDragDrop CoUninitialize CoTaskMemFree CoCreateInstance CoInitializeEx OleInitialize RegisterDragDrop

bcrypt

BCryptGenRandom

dwrite

DWriteCreateFactory

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

Name

.text

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16.2MB

Virtual Size

16.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

405KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_c5bc105fb21d26968ea00c935a014530_cobalt-strike_glassworm_icedid_satacom

user32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

version

ntdll

oleaut32

bcryptprimitives

shell32

gdi32

opengl32

imm32

ole32

bcrypt

dwrite

dwmapi

uxtheme

generic