2026-10-28_8efad2918a4a51cf137dc84a326025ed_cobalt-strike_glassworm_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_8efad2918a4a51cf137dc84a326025ed_cobalt-strike_glassworm_icedid_satacom
Size 1.3MB
Sample261029-3sdpmstxex
SHA256 746f70ba31b97c5c00597156b8e28aa6bc9ff331166a7df5cadb4ccfdb34cab7
MD5 8efad2918a4a51cf137dc84a326025ed
SHA1 e1a875addc3837b5ca987d0513c5d49d3f9c01fd
SHA512 50d04cd0bc620d3dfc1d78cec281c26914634267af08da7bf3c8048d15d4cc2626ac2fc87f30f425f17ba9b3c68764176eb88f8b9bd35486071fd94cf0c627fd
SSDEEP 24576:TnaSqkoTKNf1pNPfHU0F1ss/0pKbCiaGRa3KKXhiFBdMPMur/l5s:TnaSqdTUf1bPfTF2KOiaGRa3lRi3kMuk
TLSH
T17E557B43F66680FCC61AC078C7165673AA32789A07347AFB57D44B243EA6FD06A3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-28_8efad2918a4a51cf137dc84a326025ed_cobalt-strike_glassworm_icedid_satacom

.exe 1.3MB

2026-10-28_8efad2918a4a51cf137dc84a326025ed_cobalt-strike_glassworm_icedid_satacom

IMPHASH b1c1a831d188f2d9f2de00c4efd4ccc4
SHA256 746f70ba31b97c5c00597156b8e28aa6bc9ff331166a7df5cadb4ccfdb34cab7
MD5 8efad2918a4a51cf137dc84a326025ed
SHA1 e1a875addc3837b5ca987d0513c5d49d3f9c01fd
SHA512 50d04cd0bc620d3dfc1d78cec281c26914634267af08da7bf3c8048d15d4cc2626ac2fc87f30f425f17ba9b3c68764176eb88f8b9bd35486071fd94cf0c627fd
SSDEEP 24576:TnaSqkoTKNf1pNPfHU0F1ss/0pKbCiaGRa3KKXhiFBdMPMur/l5s:TnaSqdTUf1bPfTF2KOiaGRa3lRi3kMuk
TLSH
T17E557B43F66680FCC61AC078C7165673AA32789A07347AFB57D44B243EA6FD06A3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

3f:c1:38:f5:0d:51:1d:03:a6:98:af:07:ad:a9:59:9c:b6:6f:0d:61:e8:1d:99:06:7d:f6:09:15:bd:40:be:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=0175853,CN=SEELIV (SMC-PRIVATE) LIMITED,O=SEELIV (SMC-PRIVATE) LIMITED,L=Multan,ST=Punjab,C=PK,1.3.6.1.4.1.311.60.2.1.3=#1302504b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 23, 2026

SERIALNUMBER=0175853,CN=SEELIV (SMC-PRIVATE) LIMITED,O=SEELIV (SMC-PRIVATE) LIMITED,L=Multan,ST=Punjab,C=PK,1.3.6.1.4.1.311.60.2.1.3=#1302504b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

SERIALNUMBER=0175853,CN=SEELIV (SMC-PRIVATE) LIMITED,O=SEELIV (SMC-PRIVATE) LIMITED,L=Multan,ST=Punjab,C=PK,1.3.6.1.4.1.311.60.2.1.3=#1302504b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

52:26:a4:7e:8a:78:3f:b0:3f:83:6e:cb:18:c7:46:de

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 17, 2026 - Mar 17, 2027

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

887584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

PDF_izer_Updater.pdb

bcryptprimitives

ProcessPrng

kernel32

FindClose CopyFileExW ReadFile TerminateProcess GetExitCodeProcess FindFirstFileExW GetSystemDirectoryW GetCurrentProcessId ProcessIdToSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess QueryFullProcessImageNameW CompareStringOrdinal FlushFileBuffers LocalFree GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes PostQueuedCompletionStatus GetFinalPathNameByHandleW HeapSize LCMapStringW CompareStringW LoadLibraryExW VirtualProtect SetLastError GetCurrentProcess WaitForSingleObject CreateMutexW ReleaseMutex GetStringTypeW GetFileType CreateFileW SetEnvironmentVariableW GetModuleHandleW GetProcAddress GetQueuedCompletionStatusEx GetCurrentThreadId GetCurrentDirectoryW WriteFile WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte GetCPInfo MultiByteToWideChar FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FlsFree GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx SetHandleInformation GetOEMCP GetModuleHandleA SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx SetFileTime CreateDirectoryW ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread GetACP GetCommandLineW DeleteFileW SwitchToThread IsValidCodePage UnregisterWaitEx IsDebuggerPresent SetFilePointerEx IsProcessorFeaturePresent GetCommandLineA FreeLibrary RegisterWaitForSingleObject GetCurrentThread RtlPcToFileHeader RaiseException EncodePointer FindNextFileW FlsGetValue SetThreadStackGuarantee HeapReAlloc FormatMessageW GetLastError CloseHandle HeapAlloc HeapFree GetProcessHeap RtlLookupFunctionEntry CancelIoEx GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency WriteConsoleW GetConsoleOutputCP GetConsoleMode RtlUnwindEx EnterCriticalSection SetUnhandledExceptionFilter InitializeSListHead LeaveCriticalSection InitializeCriticalSectionEx GetStdHandle RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler DeleteCriticalSection SetStdHandle UnhandledExceptionFilter

advapi32

RegCreateKeyExW RegQueryValueExW GetTokenInformation RegOpenKeyExW RegSetValueExW RegDeleteTreeW OpenProcessToken RegCloseKey ConvertSidToStringSidW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

connect getsockopt setsockopt send bind closesocket recv WSASocketW WSAIoctl shutdown WSASend ioctlsocket getaddrinfo WSAStartup getsockname WSAGetLastError getpeername freeaddrinfo

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

crypt32

CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertDuplicateCertificateChain CertGetCertificateChain CertDuplicateStore CertAddCertificateContextToStore CertOpenStore CertDuplicateCertificateContext CertCloseStore CertFreeCertificateContext

secur32

DecryptMessage FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA AcceptSecurityContext ApplyControlToken QueryContextAttributesW EncryptMessage InitializeSecurityContextW

Name

.text

Size

945KB

Virtual Size

945KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_8efad2918a4a51cf137dc84a326025ed_cobalt-strike_glassworm_icedid_satacom

bcryptprimitives

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

version

crypt32

secur32

generic