2026-11-12_60274e4ba7f580dbb2a8bd448622c64b_cobalt-strike_glassworm_icedid_poet-rat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_60274e4ba7f580dbb2a8bd448622c64b_cobalt-strike_glassworm_icedid_poet-rat_satacom
Size 23.7MB
Sample261113-cch2bae15q
SHA256 08cd00ea0c48d26d2c835fefaa36a5a1b1f15ab8ed67767782bf5bee9749d402
MD5 60274e4ba7f580dbb2a8bd448622c64b
SHA1 fd91d8453a81199c6ec553f68b314e34fb757a2f
SHA512 618367e51dcd9fd0f02b219c9c6306b783954f34ca888acb636da8766e7c2342278eba4448f90d623ae2c75ec97caf6682b33898f007fa0747ad20198e1685fa
SSDEEP 196608:8w/mAVmJT+tWbfPytLNywJ070ZNf5ffHpJ:5/mJSWw5J0AZNR3HpJ
TLSH
T1C7474B12BA5B98ADE16AC47083468A736A3174DB0B26B9FF45C445383F6EBF01B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_60274e4ba7f580dbb2a8bd448622c64b_cobalt-strike_glassworm_icedid_poet-rat_satacom

File Explorer

2026-11-12_60274e4ba7f580dbb2a8bd448622c64b_cobalt-strike_glassworm_icedid_poet-rat_satacom

.exe 23.7MB

2026-11-12_60274e4ba7f580dbb2a8bd448622c64b_cobalt-strike_glassworm_icedid_poet-rat_satacom

IMPHASH 28d0e8b410293a62db41c6ecfa02e1e0
SHA256 08cd00ea0c48d26d2c835fefaa36a5a1b1f15ab8ed67767782bf5bee9749d402
MD5 60274e4ba7f580dbb2a8bd448622c64b
SHA1 fd91d8453a81199c6ec553f68b314e34fb757a2f
SHA512 618367e51dcd9fd0f02b219c9c6306b783954f34ca888acb636da8766e7c2342278eba4448f90d623ae2c75ec97caf6682b33898f007fa0747ad20198e1685fa
SSDEEP 196608:8w/mAVmJT+tWbfPytLNywJ070ZNf5ffHpJ:5/mJSWw5J0AZNR3HpJ
TLSH
T1C7474B12BA5B98ADE16AC47083468A736A3174DB0B26B9FF45C445383F6EBF01B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17470912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

duels_pc_checker.pdb

bcryptprimitives

ProcessPrng

kernel32

Process32NextW QueryFullProcessImageNameW Module32FirstW Module32NextW GetVolumeNameForVolumeMountPointW GetVolumePathNameW GetFileInformationByHandle GetLogicalDrives GetNamedPipeServerProcessId TerminateProcess WriteFile InitializeSListHead ReadFile GetVolumeInformationW CreateNamedPipeW GetCurrentProcessId GetProcessId GetNamedPipeClientProcessId DuplicateHandle Process32FirstW GetFileType SetStdHandle GetTimeZoneInformation IsProcessorFeaturePresent ExitThread EncodePointer FlsGetValue RtlPcToFileHeader GetStartupInfoW CreateToolhelp32Snapshot GetSystemFirmwareTable FileTimeToSystemTime GetCurrentThreadId LocalFree GetDriveTypeW SetUnhandledExceptionFilter CancelIoEx GetOverlappedResult WaitForSingleObject ConnectNamedPipe CreateEventW DeviceIoControl CreateFileW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection OpenProcess InitializeCriticalSection LoadLibraryW LoadLibraryExA FreeLibraryAndExitThread CheckRemoteDebuggerPresent GetCurrentProcess IsDebuggerPresent UnhandledExceptionFilter CompareStringW QueryPerformanceFrequency GetModuleHandleW VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile MultiByteToWideChar LoadLibraryA CreateIoCompletionPort PostQueuedCompletionStatus WideCharToMultiByte lstrlenW AddVectoredExceptionHandler GetQueuedCompletionStatusEx RtlVirtualUnwind SetFileCompletionNotificationModes RtlCaptureContext Sleep LCMapStringW FindNextFileW FindFirstFileExW GetModuleHandleA FindClose SetFilePointerEx SwitchToThread QueryPerformanceCounter LocaleNameToLCID CopyFileExW GetModuleHandleExW SetHandleInformation RtlLookupFunctionEntry GetModuleFileNameW GetProcAddress LoadLibraryExW SetFileTime SetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW SetThreadStackGuarantee GetCurrentThread SetLastError ExitProcess WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW EnterCriticalSection DeleteFileW GetFullPathNameW HeapAlloc WriteConsoleW GetStdHandle GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer FlsFree FlsAlloc IsThreadAFiber FlsSetValue FormatMessageW CloseHandle GetTempPathW GetSystemInfo CreateThread SetFileAttributesW MoveFileExW GetSystemTimePreciseAsFileTime RtlUnwindEx FreeLibrary CreateEventA SetThreadErrorMode TryAcquireSRWLockExclusive RemoveVectoredExceptionHandler IsValidCodePage AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock RaiseException AreFileApisANSI GetFileSizeEx HeapCreate OutputDebugStringA SetEndOfFile UnlockFileEx GetFileAttributesW HeapValidate HeapSize GetTickCount64 GetFileAttributesExW FlushViewOfFile HeapCompact HeapDestroy LockFileEx GetSystemTimeAsFileTime FlushFileBuffers GetACP GetOEMCP GetCPInfo GetLastError GetStringTypeW HeapReAlloc HeapFree GetProcessHeap TryEnterCriticalSection GetCurrentDirectoryW GetEnvironmentVariableW FreeEnvironmentStringsW GetCommandLineA GetEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

oleaut32

SafeArrayPutElement SafeArrayCreateVector VariantClear SysStringLen SysAllocStringLen SetErrorInfo GetErrorInfo SysFreeString

user32

CreateWindowExW GetPropW GetDC ReleaseDC CreateWindowExA SetPropW GetWindowTextLengthW SetWindowLongPtrW GetWindowTextW ShowWindow GetSystemMenu EnableMenuItem DefWindowProcW ClientToScreen RemovePropW SetWindowLongW GetWindowLongW RegisterClassExW GetClassInfoExA DefWindowProcA ValidateRect TrackMouseEvent GetShellWindow SetCapture MonitorFromRect ScreenToClient GetMenu GetWindowThreadProcessId ReleaseCapture MsgWaitForMultipleObjectsEx AdjustWindowRectEx GetCursorPos MessageBoxW IsProcessDPIAware GetAsyncKeyState SystemParametersInfoW MonitorFromWindow ToUnicodeEx GetClipCursor GetMonitorInfoW GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo GetKeyboardLayout SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow GetKeyState RegisterWindowMessageA SetWindowDisplayAffinity DestroyCursor CreateIconIndirect MapVirtualKeyExW SetCursorPos SetWindowTextW GetKeyboardState CreateIcon DestroyIcon GetWindowRect FlashWindowEx SetWindowPlacement GetWindowPlacement ShowCursor ChangeDisplaySettingsExW GetRawInputData ClipCursor SetCursor CallWindowProcW LoadCursorW InvalidateRgn SetWindowPos MonitorFromPoint SendMessageW GetSystemMetrics GetActiveWindow CreateIconFromResourceEx RegisterRawInputDevices IsIconic GetTouchInputInfo CloseTouchInputHandle GetClientRect EnumDisplayMonitors GetWindowLongPtrW RegisterTouchWindow DestroyWindow DispatchMessageW PostMessageW SetWindowCompositionAttribute TranslateMessage PeekMessageW IsWindowVisible SystemParametersInfoA RedrawWindow RegisterClassExA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW RegEnumValueW RegEnumKeyExW GetTokenInformation SystemFunction036 RegQueryValueExW RegQueryInfoKeyW OpenProcessToken RegCloseKey AuditQuerySystemPolicy AuditFree RegOpenKeyExW

ws2_32

getaddrinfo connect WSAIoctl send ioctlsocket WSASend shutdown WSAGetLastError recv getsockopt closesocket select getsockname getpeername WSAStartup freeaddrinfo WSARecv setsockopt WSASocketW bind

wevtapi

EvtOpenChannelConfig EvtClose EvtQuery EvtGetChannelConfigProperty EvtNext EvtRender EvtOpenLog EvtGetLogInfo

iphlpapi

GetAdaptersAddresses

shell32

ShellExecuteExW DragFinish DragQueryFileW SHGetKnownFolderPath

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

ole32

RegisterDragDrop CoInitializeEx StringFromGUID2 CoInitializeSecurity CoCreateInstance CoUninitialize RevokeDragDrop OleInitialize

bcrypt

BCryptGenRandom

ntdll

NtWriteFile NtReadFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtOpenFile

crypt32

CertFreeCertificateContext CertCreateCertificateChainEngine CertGetCertificateChain CertOpenStore CertSetCertificateContextProperty CertCloseStore CertVerifyCertificateChainPolicy CertAddEncodedCertificateToStore CertFreeCertificateChain CertFreeCertificateChainEngine

gdi32

ChoosePixelFormat GetDeviceCaps DescribePixelFormat CreateRectRgn CreateBitmap GetPixelFormat SetPixelFormat DeleteObject SetBitmapBits SwapBuffers CreateCompatibleBitmap

uiautomationcore

UiaGetReservedMixedAttributeValue UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaLookupId UiaHostProviderFromHwnd

opengl32

wglGetCurrentContext wglGetProcAddress wglCreateContext wglDeleteContext wglMakeCurrent

dxgi

CreateDXGIFactory1

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW

vssapi

CreateVssBackupComponentsInternal VssFreeSnapshotPropertiesInternal

imm32

ImmGetCompositionStringW ImmAssociateContextEx ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

uxtheme

SetWindowTheme

Name

.text

Size

17.3MB

Virtual Size

17.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

537KB

Virtual Size

537KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_60274e4ba7f580dbb2a8bd448622c64b_cobalt-strike_glassworm_icedid_poet-rat_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

oleaut32

user32

advapi32

ws2_32

wevtapi

iphlpapi

shell32

combase

dwmapi

ole32

bcrypt

ntdll

crypt32

gdi32

uiautomationcore

opengl32

dxgi

setupapi

vssapi

imm32

uxtheme

generic