2026-10-22_4a95d1ec520275aa824788550c84c360_cobalt-strike_glassworm_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_4a95d1ec520275aa824788550c84c360_cobalt-strike_glassworm_icedid_satacom
Size 9.0MB
Sample261024-red8gaat6w
SHA256 520d6cb9eb4dbe72d7a23d1d31c5d36bbf767f9cc0fe648602397c44827e61fc
MD5 4a95d1ec520275aa824788550c84c360
SHA1 330dfd20b0d1bb91c6d243cfda40514b58578882
SHA512 d0914400afd07457e06a3037acd05e1d7854bb1d0e0e85cf3f87c5b421e4242f348a4f074ab57b6ea93a1eed98dc8a2d9c4e6f11841f98b5a2696f08c705d45c
SSDEEP 98304:HLku/WyZeJp8GMoI9ZJfSgmCFoMQT6gsYHKjxumcguOBmesfH7VJy1H+n:3ZOHQFoWgRqFbB/6bV0F
TLSH
T1EA962943F66691ECC16AC174871A6233FB71BC8D0B247AE75BD08B213E66F906A3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_4a95d1ec520275aa824788550c84c360_cobalt-strike_glassworm_icedid_satacom

File Explorer

2026-10-22_4a95d1ec520275aa824788550c84c360_cobalt-strike_glassworm_icedid_satacom

.exe 9.0MB

2026-10-22_4a95d1ec520275aa824788550c84c360_cobalt-strike_glassworm_icedid_satacom

IMPHASH 9b17a5a695371318d716d7dae6213c0e
SHA256 520d6cb9eb4dbe72d7a23d1d31c5d36bbf767f9cc0fe648602397c44827e61fc
MD5 4a95d1ec520275aa824788550c84c360
SHA1 330dfd20b0d1bb91c6d243cfda40514b58578882
SHA512 d0914400afd07457e06a3037acd05e1d7854bb1d0e0e85cf3f87c5b421e4242f348a4f074ab57b6ea93a1eed98dc8a2d9c4e6f11841f98b5a2696f08c705d45c
SSDEEP 98304:HLku/WyZeJp8GMoI9ZJfSgmCFoMQT6gsYHKjxumcguOBmesfH7VJy1H+n:3ZOHQFoWgRqFbB/6bV0F
TLSH
T1EA962943F66691ECC16AC174871A6233FB71BC8D0B247AE75BD08B213E66F906A3D714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7407968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

memora.pdb

bcryptprimitives

ProcessPrng

kernel32

DeleteFileW SwitchToThread MoveFileExW GetExitCodeProcess WaitForMultipleObjects GetTimeZoneInformationForYear SystemTimeToFileTime PostQueuedCompletionStatus GetLastError GetSystemTimePreciseAsFileTime CreateThread SetFilePointerEx FindNextFileW SetConsoleCtrlHandler CloseHandle GetSystemInfo SetThreadStackGuarantee GetTickCount GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx LocalFree UnlockFile GetNativeSystemInfo GetCurrentThread CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile AreFileApisANSI DuplicateHandle FindClose GetCurrentProcessId GetModuleHandleA GetProcAddress GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW ReadFile GetOverlappedResult CancelIo CreateEventW ExitProcess CreateDirectoryW CreateWaitableTimerExW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime CreateFileW FindFirstFileExW GetFullPathNameW SetFileInformationByHandle SetWaitableTimer WaitForSingleObject DeleteFileA Sleep SetHandleInformation FlushFileBuffers WriteFileEx ReadFileEx SleepEx FlsFree FlsSetValue IsThreadAFiber FlsAlloc WriteConsoleW GetQueuedCompletionStatusEx GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcess WaitForSingleObjectEx GetCurrentThreadId SetFileCompletionNotificationModes CreateIoCompletionPort GetFinalPathNameByHandleW SetLastError SetStdHandle GetFileType IsProcessorFeaturePresent GetStartupInfoW FlsGetValue ExitThread TerminateProcess GetOEMCP GetACP GetCPInfo GetStringTypeW IsValidCodePage LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA FreeLibraryAndExitThread RtlPcToFileHeader InitializeCriticalSectionEx EncodePointer RtlUnwindEx InitializeSListHead SetUnhandledExceptionFilter DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException HeapCreate GetProcessHeap OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize OutputDebugStringW FlushViewOfFile LoadLibraryW HeapCompact HeapDestroy FormatMessageA CreateFileMappingW MapViewOfFile GetModuleFileNameW FreeEnvironmentStringsW HeapFree GetEnvironmentStringsW CompareStringOrdinal QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW HeapAlloc GetModuleHandleExW MultiByteToWideChar FormatMessageW GetModuleHandleW WideCharToMultiByte lstrlenW LoadLibraryA GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext AddVectoredExceptionHandler HeapReAlloc SetEnvironmentVariableW GetCommandLineW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ws2_32

getsockopt WSADuplicateSocketW setsockopt WSASend getsockname WSAIoctl connect WSAGetLastError accept listen bind ioctlsocket WSASocketW shutdown recv WSARecv closesocket getpeername freeaddrinfo select getaddrinfo send WSAStartup

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtCreateNamedPipeFile NtCreateFile NtDeviceIoControlFile NtWriteFile NtOpenFile NtReadFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_4a95d1ec520275aa824788550c84c360_cobalt-strike_glassworm_icedid_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

generic