2026-10-22_0e8aaa0114836864b4f0eac76f596842_cobalt-strike_glassworm_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_0e8aaa0114836864b4f0eac76f596842_cobalt-strike_glassworm_icedid_satacom
Size 9.0MB
Sample261024-1pcbaset6p
SHA256 4d25b02fa9e383a04a713a4c5660a8b40a9eaa5a4d26a8a9a5c3024e6383e8bf
MD5 0e8aaa0114836864b4f0eac76f596842
SHA1 ee420fdb31ddd633d616de6f424f10e6757fe8fb
SHA512 95cccfc86614fbd6ef490241b3a61f9fe5e3bda57e338d3e2a5a2732f3e91239d5c0697165e907e0983b8b21f010ce394f8cc83d8e5d7ec44b4acf5722a6a43b
SSDEEP 98304:S2j5HFGAep6hewjLcXfTDNXcG8pJdpI4F6UoJmx1eBiSWEPlA+cZ6UQQVJ7NwPHi:3lI/LWy4YwvIj+5n7V1Nwvi
TLSH
T155962A47F6A291ECC16AC074871A6233FB71BC4D07247AEB5BD08B213E66F906A3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_0e8aaa0114836864b4f0eac76f596842_cobalt-strike_glassworm_icedid_satacom

File Explorer

2026-10-22_0e8aaa0114836864b4f0eac76f596842_cobalt-strike_glassworm_icedid_satacom

.exe 9.0MB

2026-10-22_0e8aaa0114836864b4f0eac76f596842_cobalt-strike_glassworm_icedid_satacom

IMPHASH 9b17a5a695371318d716d7dae6213c0e
SHA256 4d25b02fa9e383a04a713a4c5660a8b40a9eaa5a4d26a8a9a5c3024e6383e8bf
MD5 0e8aaa0114836864b4f0eac76f596842
SHA1 ee420fdb31ddd633d616de6f424f10e6757fe8fb
SHA512 95cccfc86614fbd6ef490241b3a61f9fe5e3bda57e338d3e2a5a2732f3e91239d5c0697165e907e0983b8b21f010ce394f8cc83d8e5d7ec44b4acf5722a6a43b
SSDEEP 98304:S2j5HFGAep6hewjLcXfTDNXcG8pJdpI4F6UoJmx1eBiSWEPlA+cZ6UQQVJ7NwPHi:3lI/LWy4YwvIj+5n7V1Nwvi
TLSH
T155962A47F6A291ECC16AC074871A6233FB71BC4D07247AEB5BD08B213E66F906A3D754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7466784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

memora.pdb

bcryptprimitives

ProcessPrng

kernel32

DeleteFileW SwitchToThread MoveFileExW GetExitCodeProcess WaitForMultipleObjects GetTimeZoneInformationForYear SystemTimeToFileTime PostQueuedCompletionStatus GetLastError GetSystemTimePreciseAsFileTime CreateThread SetFilePointerEx FindNextFileW SetConsoleCtrlHandler CloseHandle GetSystemInfo SetThreadStackGuarantee GetTickCount GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx LocalFree UnlockFile GetNativeSystemInfo GetCurrentThread CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile AreFileApisANSI DuplicateHandle FindClose GetCurrentProcessId GetModuleHandleA GetProcAddress GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW ReadFile GetOverlappedResult CancelIo CreateEventW ExitProcess CreateDirectoryW CreateWaitableTimerExW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime CreateFileW FindFirstFileExW GetFullPathNameW SetFileInformationByHandle SetWaitableTimer WaitForSingleObject DeleteFileA Sleep SetHandleInformation FlushFileBuffers WriteFileEx ReadFileEx SleepEx FlsFree FlsSetValue IsThreadAFiber FlsAlloc WriteConsoleW GetQueuedCompletionStatusEx GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcess WaitForSingleObjectEx GetCurrentThreadId SetFileCompletionNotificationModes CreateIoCompletionPort GetFinalPathNameByHandleW SetLastError SetStdHandle GetFileType IsProcessorFeaturePresent GetStartupInfoW FlsGetValue ExitThread TerminateProcess GetOEMCP GetACP GetCPInfo GetStringTypeW IsValidCodePage LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA FreeLibraryAndExitThread RtlPcToFileHeader InitializeCriticalSectionEx EncodePointer RtlUnwindEx InitializeSListHead SetUnhandledExceptionFilter DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException HeapCreate GetProcessHeap OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize OutputDebugStringW FlushViewOfFile LoadLibraryW HeapCompact HeapDestroy FormatMessageA CreateFileMappingW MapViewOfFile GetModuleFileNameW FreeEnvironmentStringsW HeapFree GetEnvironmentStringsW CompareStringOrdinal QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW HeapAlloc GetModuleHandleExW MultiByteToWideChar FormatMessageW GetModuleHandleW WideCharToMultiByte lstrlenW LoadLibraryA GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext AddVectoredExceptionHandler HeapReAlloc SetEnvironmentVariableW GetCommandLineW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ws2_32

getsockopt WSADuplicateSocketW setsockopt WSASend getsockname WSAIoctl connect WSAGetLastError accept listen bind ioctlsocket WSASocketW shutdown recv WSARecv closesocket getpeername freeaddrinfo select getaddrinfo send WSAStartup

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtCreateNamedPipeFile NtCreateFile NtDeviceIoControlFile NtWriteFile NtOpenFile NtReadFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

139KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0e8aaa0114836864b4f0eac76f596842_cobalt-strike_glassworm_icedid_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

generic