General
- Target 2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom
- Size 60.6MB
- Sample261113-e6k4wazx4q
- SHA256 71e4d784950e01efb3a64dea5d6c07bc662fb7620258ef158ea88e9f2caa2d62
- MD5 414c886c3d6cec0d9d3ccea645362a99
- SHA1 a0d79fec256ef13fe193ec28bc7ffe1bfd95f764
- SHA512 ee1907fb05df0b78567aeb06151adae8e6ad391837226367e7fb28945a0c605ce36d349c37f7566ef90c82381a81bfb6e0b3b6afe1b6d3646be9129b5c6e785c
- SSDEEP 393216:h8enxSqMKIW7y1a8YmO5RzJ/WIczzoGw+J4rV:h/nxSq77y1a/5RFW8h/
- TLSH T189D7E7113B9BA8ADD55AC87083464A631E2130DB1A36B9FF84D496353F7EAF46B3C314
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom
- Size 60.6MB
- SHA256 71e4d784950e01efb3a64dea5d6c07bc662fb7620258ef158ea88e9f2caa2d62
- MD5 414c886c3d6cec0d9d3ccea645362a99
- SHA1 a0d79fec256ef13fe193ec28bc7ffe1bfd95f764
- SHA512 ee1907fb05df0b78567aeb06151adae8e6ad391837226367e7fb28945a0c605ce36d349c37f7566ef90c82381a81bfb6e0b3b6afe1b6d3646be9129b5c6e785c
- SSDEEP 393216:h8enxSqMKIW7y1a8YmO5RzJ/WIczzoGw+J4rV:h/nxSq77y1a/5RFW8h/
- TLSH T189D7E7113B9BA8ADD55AC87083464A631E2130DB1A36B9FF84D496353F7EAF46B3C314
- MD5 SHA1 SHA512 SSDEEP TLSH
Deletes itself
Executes dropped EXE
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.