2026-10-01_23c65c01d7b8b3e067ca763e179a180c_cobalt-strike_gazer_glassworm_helldown_mespinoza_remcos_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_23c65c01d7b8b3e067ca763e179a180c_cobalt-strike_gazer_glassworm_helldown_mespinoza_remcos_satacom
Size 11.7MB
Sample261002-wwac3avbja
SHA256 63b7d722aa24847aea8205f5355f4bd05dfa0c7451bbadb36ff00d9621b6ca78
MD5 23c65c01d7b8b3e067ca763e179a180c
SHA1 b663fc2f0cfef1bc154101c7f732a34867bf721a
SHA512 58c9540bc8649bb144e68baae4466f6d4692ed52109af821a01a760c9e4b6c4437dc2dd0905e8d6b8d47ae6622acdc365b8d336b09bf170a1e1f43cd2d57751b
SSDEEP 98304:qY0v0cTJIqxCzQ43XDMdLRL17MVOMqRaz2mdMrOCSOcO:qMeIqI0RL2VqcO
TLSH
T11BC6A5176736A1E8C1BBC03891536A23FD7138CD873967739A5186322B64BF4BA7DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_23c65c01d7b8b3e067ca763e179a180c_cobalt-strike_gazer_glassworm_helldown_mespinoza_remcos_satacom

File Explorer

2026-10-01_23c65c01d7b8b3e067ca763e179a180c_cobalt-strike_gazer_glassworm_helldown_mespinoza_remcos_satacom

.exe 11.7MB

2026-10-01_23c65c01d7b8b3e067ca763e179a180c_cobalt-strike_gazer_glassworm_helldown_mespinoza_remcos_satacom

IMPHASH f5c333ac4ddb5621095b99cdf5d92702
SHA256 63b7d722aa24847aea8205f5355f4bd05dfa0c7451bbadb36ff00d9621b6ca78
MD5 23c65c01d7b8b3e067ca763e179a180c
SHA1 b663fc2f0cfef1bc154101c7f732a34867bf721a
SHA512 58c9540bc8649bb144e68baae4466f6d4692ed52109af821a01a760c9e4b6c4437dc2dd0905e8d6b8d47ae6622acdc365b8d336b09bf170a1e1f43cd2d57751b
SSDEEP 98304:qY0v0cTJIqxCzQ43XDMdLRL17MVOMqRaz2mdMrOCSOcO:qMeIqI0RL2VqcO
TLSH
T11BC6A5176736A1E8C1BBC03891536A23FD7138CD873967739A5186322B64BF4BA7DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9759200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0facet@locale@std@@IEAA@_K@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?bad@ios_base@std@@QEBA_NXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?classic@locale@std@@SAAEBV12@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ?flags@ios_base@std@@QEBAHXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?is@?$ctype@D@std@@QEBA_NFD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?uncaught_exceptions@std@@YAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z _Cnd_broadcast _Cnd_do_broadcast_at_thread_exit _Cnd_signal _Cnd_wait _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_id _Thrd_join _Xtime_get_ticks

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

ws2_32

WSACleanup WSAGetLastError WSAPoll WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getsockname getsockopt inet_pton ioctlsocket listen recv recvfrom select send setsockopt shutdown socket

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptGetProvParam CryptHashData CryptReleaseContext

kernel32

AcquireSRWLockExclusive AreFileApisANSI CancelIo CloseHandle CopyFile2 CreateDirectoryW CreateEventW CreateFile2 CreateFileA CreateFileW CreateHardLinkW CreatePipe CreateProcessA CreateProcessW CreateSymbolicLinkW DeleteFileW DeviceIoControl DuplicateHandle FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageA FreeLibrary GenerateConsoleCtrlEvent GetACP GetCommandLineW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceW GetDriveTypeW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetNativeSystemInfo GetNumberOfConsoleInputEvents GetOEMCP GetOverlappedResult GetProcAddress GetStdHandle GetSystemTimeAsFileTime GetTempPathW GetUserDefaultLocaleName GetVolumePathNameW GlobalMemoryStatusEx InitOnceBeginInitialize InitOnceComplete InitializeSListHead IsValidCodePage LoadLibraryA LoadLibraryExA LocalFree MoveFileExA MoveFileExW MultiByteToWideChar OpenProcess PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleInputW ReadFile ReleaseSRWLockExclusive ResetEvent SearchPathA SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFileTime SetHandleInformation SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess VirtualAlloc VirtualFree WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __RTDynamicCast __current_exception __current_exception_context __intrinsic_setjmp __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare _purecall longjmp memchr memcmp memcpy memmove memset strchr strrchr strstr wcschr wcsrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf _close _commit _dup _dup2 _fflush_nolock _fileno _fseeki64 _ftelli64 _fwrite_nolock _get_osfhandle _get_stream_buffer_pointers _isatty _lseeki64 _open _open_osfhandle _pclose _pipe _popen _read _set_fmode _setmode _sopen_s _wopen _write _wsopen_s clearerr fclose feof ferror fflush fgetc fgetpos fgets fopen fputc fputs fread freopen fseek fsetpos ftell fwrite getc setbuf setvbuf tmpfile tmpnam ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _errno _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _wassert abort exit signal strerror system terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr _dsign _fdopen _fdsign _ldsign acos asin atan2 ceil ceilf cos cosf exp floor fmod fmodf frexp ldexp llround log log10 pow powf sin sinf sqrt sqrtf tan

api-ms-win-crt-time-l1-1-0

_ctime64_s _difftime64 _get_timezone _gmtime64 _gmtime64_s _localtime64 _localtime64_s _mktime64 _time64 clock strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _umask _unlock_file _wrename _wrmdir _wunlink remove rename

api-ms-win-crt-environment-l1-1-0

_putenv_s getenv

api-ms-win-crt-convert-l1-1-0

atoi mbstowcs strtod strtoimax strtol strtoll strtoul strtoull strtoumax wcrtomb wcstombs

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc realloc

api-ms-win-crt-string-l1-1-0

_strdup _wcsdup isalnum isalpha iscntrl isdigit isgraph islower isprint ispunct isspace isupper isxdigit strcat strcmp strcoll strcpy strcspn strlen strncmp strncpy strpbrk strspn tolower toupper wcscmp wcscpy wcslen wcsncmp wcsncpy

api-ms-win-crt-utility-l1-1-0

bsearch lldiv qsort rand

Name

.text

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

114KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

542KB

Virtual Size

541KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_23c65c01d7b8b3e067ca763e179a180c_cobalt-strike_gazer_glassworm_helldown_mespinoza_remcos_satacom

bcrypt

msvcp140

msvcp140_atomic_wait

ws2_32

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic