2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom
Size 40.6MB
Sample261102-3115xage87
SHA256 5db1bfeb4a0e698df944973650cc1cf9d4257b8ecbb8c4cacc66879d4df67009
MD5 be1ca72267c20ee620e359d6dd272990
SHA1 67302875e0ec247195b32071d0be9f4f13b833d4
SHA512 bae4a6b98441b3404734c643ef2f56ce5589e91530f9f8e9a016dc5df80a2bc930d7873093b750abdae717e5975b618ab8c34dece25d46c6f68607b24908d5eb
SSDEEP 393216:xz0PBwOiQQqVDut46tDiA9ZvIRpjRl/bvx:xoXQqgtErRljv
TLSH
T128971811BB5A686DD15AC8B0830A4A335A3434DB1B36B9FF44D492393FBDAF45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom

File Explorer

2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom

.exe 40.6MB

2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom

IMPHASH 5d9a392bcff534189e8c9847b015ad9e
SHA256 5db1bfeb4a0e698df944973650cc1cf9d4257b8ecbb8c4cacc66879d4df67009
MD5 be1ca72267c20ee620e359d6dd272990
SHA1 67302875e0ec247195b32071d0be9f4f13b833d4
SHA512 bae4a6b98441b3404734c643ef2f56ce5589e91530f9f8e9a016dc5df80a2bc930d7873093b750abdae717e5975b618ab8c34dece25d46c6f68607b24908d5eb
SSDEEP 393216:xz0PBwOiQQqVDut46tDiA9ZvIRpjRl/bvx:xoXQqgtErRljv
TLSH
T128971811BB5A686DD15AC8B0830A4A335A3434DB1B36B9FF44D492393FBDAF45B38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30546176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

horizon_launcher.pdb

kernel32

HeapSize LCMapStringW CompareStringW LoadLibraryExW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage AttachConsole IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsGetValue RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead SetStdHandle GetStdHandle UnhandledExceptionFilter CloseHandle WaitForSingleObject CreateEventW RegisterWaitForSingleObject UnregisterWaitEx QueryPerformanceFrequency FreeLibrary GetModuleHandleExW WideCharToMultiByte GetSystemTimeAsFileTime GetCurrentThread HeapAlloc SetThreadPriority FindNextFileW GetTempPathW WaitForMultipleObjects GetFileType GetTimeZoneInformationForYear FlsSetValue IsThreadAFiber FlsAlloc RtlLookupFunctionEntry GetLastError FlsFree GetFileAttributesW SetHandleInformation SetWaitableTimer GetFileInformationByHandle CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar ReadConsoleW PowerSetRequest PowerCreateRequest GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW DeleteFileW GetUserDefaultLocaleName CompareStringOrdinal GetBinaryTypeW DeviceIoControl CreateSymbolicLinkW GetFinalPathNameByHandleW CloseThreadpoolTimer WaitForSingleObjectEx GetCurrentThreadId SwitchToThread ExitProcess Sleep FreeEnvironmentStringsW FindFirstFileExW SetFileAttributesW RemoveDirectoryW SetLastError HeapFree SetThreadpoolTimer GetCommandLineW TrySubmitThreadpoolCallback GlobalUnlock RtlCaptureContext GlobalAlloc GlobalLock SetThreadStackGuarantee GlobalFree AddVectoredExceptionHandler GetCurrentProcess SetFilePointerEx GetExitCodeProcess GetEnvironmentStringsW GlobalSize TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx SetFileTime CancelIo GetFullPathNameW GetSystemTimePreciseAsFileTime LocaleNameToLCID LockFileEx MoveFileExW SetFileInformationByHandle GetOverlappedResult ReadFile GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo ProcessIdToSessionId GetSystemInfo VirtualProtect CreateFileMappingW DuplicateHandle FlushFileBuffers GetShortPathNameW WriteFileEx GlobalMemoryStatusEx GetUserPreferredUILanguages SleepEx MapViewOfFile LoadLibraryA GetProcAddress FormatMessageW CreateFileW GetProcessHeap LoadLibraryExA CopyFileExW CreateHardLinkW HeapReAlloc QueryPerformanceCounter GetCurrentProcessId GetModuleHandleA RtlVirtualUnwind CreateThread PowerClearRequest UnmapViewOfFile lstrlenW CreateMutexA CreateDirectoryW ReleaseMutex CreateThreadpoolTimer GetModuleHandleW FindClose GetCurrentPackageFullName ReadFileEx GetCurrentDirectoryW

advapi32

CredReadW RegQueryValueExW RegSetValueExW RegCloseKey RegCreateKeyTransactedW SystemFunction036 RegCreateKeyExW RegOpenKeyTransactedW CredDeleteW RegOpenKeyExW CredWriteW CredFree

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoIncrementMTAUsage

user32

PostMessageW PeekMessageW TranslateMessage DispatchMessageW GetProcessWindowStation GetKeyboardState MapVirtualKeyW GetKeyboardLayoutNameW DefWindowProcW SystemParametersInfoW SendMessageW SetWindowLongPtrW LoadImageW GetActiveWindow RedrawWindow RegisterSuspendResumeNotification ToUnicode GetWindowLongPtrW CreateWindowExW RegisterClassW ClientToScreen PostQuitMessage GetSystemMetricsForDpi GetUserObjectInformationW CloseClipboard EnumDisplaySettingsW RegisterClipboardFormatW GetClipboardFormatNameW GetClipboardData EnumClipboardFormats CountClipboardFormats EmptyClipboard EnumDisplayMonitors OpenClipboard SetClipboardData GetKeyState SetWindowPos SetCursor GetMessageW SetWindowTextW GetForegroundWindow MessageBeep MonitorFromPoint KillTimer EnumThreadWindows GetClassNameW GetClientRect GetWindowPlacement SetTimer GetDoubleClickTime GetSystemMetrics GetPointerType GetMonitorInfoW SetCapture TrackMouseEvent ReleaseCapture IsZoomed GetDpiForWindow EnableWindow IsWindowEnabled MonitorFromWindow GetFocus ScreenToClient GetCursorPos UnregisterSuspendResumeNotification SetForegroundWindow SendInput SetFocus SetActiveWindow DestroyWindow ShowWindowAsync SetWindowPlacement ValidateRect FlashWindowEx SetPropW RemovePropW GetWindowRect IsWindowVisible IsIconic

ole32

RevokeDragDrop OleUninitialize CoCreateInstance RegisterDragDrop CoUninitialize CoInitializeEx OleInitialize ReleaseStgMedium PropVariantClear

comctl32

TaskDialogIndirect

dwrite

DWriteCreateFactory

imm32

ImmSetCompositionWindow ImmNotifyIME ImmAssociateContextEx ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmSetCandidateWindow

icuuc

u_strlen

dcomp

DCompositionCreateDevice

shell32

SetCurrentProcessExplicitAppUserModelID DragQueryFileW SHCreateItemFromParsingName SHGetKnownFolderPath ShellExecuteW SHGetDesktopFolder SHOpenFolderAndSelectItems

bcryptprimitives

ProcessPrng

dwmapi

DwmFlush DwmGetCompositionTimingInfo DwmSetWindowAttribute

gdi32

CreateSolidBrush

winmm

timeBeginPeriod timeEndPeriod

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

ntdll

NtWriteFile RtlGetVersion NtOpenFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaLookupId

oleaut32

SysStringLen SysFreeString SafeArrayCreateVector SysAllocStringLen SetErrorInfo GetErrorInfo VariantClear SafeArrayPutElement

ws2_32

closesocket freeaddrinfo select WSAStartup setsockopt accept getsockname WSAGetLastError getaddrinfo WSARecv WSASend ioctlsocket connect getsockopt recv send WSASocketW bind listen getpeername WSADuplicateSocketW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

Name

.text

Size

29.8MB

Virtual Size

29.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

263KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

combase

user32

ole32

comctl32

dwrite

imm32

icuuc

dcomp

shell32

bcryptprimitives

dwmapi

gdi32

winmm

dxgi

d3d11

ntdll

api-ms-win-shcore-scaling-l1-1-1

uiautomationcore

oleaut32

ws2_32

api-ms-win-core-winrt-error-l1-1-0

iphlpapi

bcrypt

userenv

generic