2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar
Size 8.9MB
Sample261102-3b3mfazy5j
SHA256 37454236cb8f78c1083b9129b3022f6ea5a142564341253d056d36dfda378095
MD5 c41dbe4f8c297638af63c523e9d1702c
SHA1 c51f55587bf5d0d6137c9f5c46b8c31ab5d7a394
SHA512 09e0e57b2e9b1d1acb08217d0d3f5fc0a99d21e8bea7aa11e3d2756078b6fca5d6e2392fa24a5fff05ffbc9a3181819d3ec9cd707e0b65d43487ba1a7f3792a6
SSDEEP 98304:7c4wCHNRasQ65ATWTNHR7eKTsUWS0OGTA7wRGpj3:gjCjaRKZH1dsUVGoF9
TLSH
T142964A625E46685CC91BC530939AAA761C3034CB9F35FAEFCA4991382F74AF42F3D614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar

File Explorer

2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar

.exe 8.9MB

2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar

IMPHASH ec4991c5fb1be62a16481b56e287c5f0
SHA256 37454236cb8f78c1083b9129b3022f6ea5a142564341253d056d36dfda378095
MD5 c41dbe4f8c297638af63c523e9d1702c
SHA1 c51f55587bf5d0d6137c9f5c46b8c31ab5d7a394
SHA512 09e0e57b2e9b1d1acb08217d0d3f5fc0a99d21e8bea7aa11e3d2756078b6fca5d6e2392fa24a5fff05ffbc9a3181819d3ec9cd707e0b65d43487ba1a7f3792a6
SSDEEP 98304:7c4wCHNRasQ65ATWTNHR7eKTsUWS0OGTA7wRGpj3:gjCjaRKZH1dsUVGoF9
TLSH
T142964A625E46685CC91BC530939AAA761C3034CB9F35FAEFCA4991382F74AF42F3D614
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5610248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

application_opt.pdb

user32

CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageW EnumDisplayDevicesW EnumWindows GetClassNameA GetSystemMetrics KillTimer LoadCursorW MessageBoxW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostThreadMessageW RegisterClassA RegisterWindowMessageA SetTimer TranslateMessage

kernel32

AddDllDirectory AllocConsole AttachConsole CloseHandle ConnectNamedPipe CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileW CreateMutexA CreateNamedPipeW CreatePipe CreateProcessW CreateThread CreateTimerQueue CreateTimerQueueTimer CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeleteTimerQueue DeleteTimerQueueTimer DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushInstructionCache FormatMessageW FreeEnvironmentStringsW FreeLibrary GetActiveProcessorCount GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleScreenBufferInfo GetConsoleTitleW GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFileTime GetFinalPathNameByHandleW GetLastError GetLogicalDriveStringsW GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetUserPreferredUILanguages GetVolumeInformationW GlobalFree GlobalMemoryStatusEx HeapAlloc HeapCreate HeapFree HeapReAlloc InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MoveFileExW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadFile ReleaseMutex RemoveDirectoryW RemoveDllDirectory ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetConsoleTitleW SetDefaultDllDirectories SetDllDirectoryW SetEvent SetFileAttributesW SetFilePointer SetFileTime SetProcessPriorityBoost SetThreadContext SetThreadErrorMode SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile lstrcmpA

gdi32

GetStockObject

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext GetUserNameW RegCloseKey RegCreateKeyExA RegCreateKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

shell32

CommandLineToArgvW SHGetDesktopFolder SHGetDiskFreeSpaceExW SHGetFolderPathA SHGetFolderPathW SHGetSpecialFolderLocation ShellExecuteW

ole32

CoGetApartmentType CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize OleUninitialize

oleaut32

SafeArrayAccessData SafeArrayUnaccessData VariantClear VariantInit VariantTimeToSystemTime

imagehlp

ImageLoad ImageUnload SymCleanup SymGetModuleInfo64 SymGetSymFromAddr64 SymInitialize UnDecorateSymbolName

psapi

EnumProcessModules GetModuleFileNameExW GetProcessMemoryInfo

rpcrt4

RpcStringFreeA UuidCreate UuidFromStringA UuidToStringA

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize RoUninitialize

wintrust

WinVerifyTrust

vcruntime140

__C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_terminate memcmp memcpy memmove memset strchr strrchr strstr wcschr wcsrchr wcsstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vswscanf _close _fseeki64 _ftelli64 _getcwd _set_fmode _wfdopen _wfopen _wsopen_s fclose feof ferror fflush fopen fopen_s fputc fputs fread freopen fseek ftell fwrite setbuf setvbuf

api-ms-win-crt-runtime-l1-1-0

_beginthread _c_exit _cexit _clearfp _configure_narrow_argv _controlfp _crt_atexit _errno _exit _get_narrow_winmain_command_line _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit strerror terminate

api-ms-win-crt-locale-l1-1-0

_configthreadlocale _create_locale

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest _fdtest

api-ms-win-crt-filesystem-l1-1-0

_fullpath _splitpath_s _wrename

api-ms-win-crt-time-l1-1-0

_gmtime64_s _localtime64_s _time64 _tzset strftime

api-ms-win-crt-convert-l1-1-0

_ltow_s _strtod_l atol mbstowcs_s wcstombs wcstombs_s

api-ms-win-crt-environment-l1-1-0

_putenv_s _wgetenv _wgetenv_s

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _wcsicmp _wcslwr _wcsnicmp islower isspace iswctype strcat strcat_s strcmp strcpy strcpy_s strlen strncat strncmp strncpy strnlen strtok_s tolower toupper towlower towupper wcscat wcscat_s wcscmp wcscpy wcscpy_s wcscspn wcslen wcsncat_s wcsncmp wcsncpy wcsncpy_s wcstok_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64 _byteswap_ulong rand rand_s srand

Name

.text

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

383KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

12B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

28B

Characteristics

Name

.rsrc

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar

user32

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

imagehlp

psapi

rpcrt4

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

wintrust

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic