2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom
Size 60.6MB
Sample261113-e6k4wazx4q
SHA256 71e4d784950e01efb3a64dea5d6c07bc662fb7620258ef158ea88e9f2caa2d62
MD5 414c886c3d6cec0d9d3ccea645362a99
SHA1 a0d79fec256ef13fe193ec28bc7ffe1bfd95f764
SHA512 ee1907fb05df0b78567aeb06151adae8e6ad391837226367e7fb28945a0c605ce36d349c37f7566ef90c82381a81bfb6e0b3b6afe1b6d3646be9129b5c6e785c
SSDEEP 393216:h8enxSqMKIW7y1a8YmO5RzJ/WIczzoGw+J4rV:h/nxSq77y1a/5RFW8h/
TLSH
T189D7E7113B9BA8ADD55AC87083464A631E2130DB1A36B9FF84D496353F7EAF46B3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom

File Explorer

2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom

.exe 60.6MB

2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom

IMPHASH 36e0572a8e932b0a09fe5fc98ec3ba27
SHA256 71e4d784950e01efb3a64dea5d6c07bc662fb7620258ef158ea88e9f2caa2d62
MD5 414c886c3d6cec0d9d3ccea645362a99
SHA1 a0d79fec256ef13fe193ec28bc7ffe1bfd95f764
SHA512 ee1907fb05df0b78567aeb06151adae8e6ad391837226367e7fb28945a0c605ce36d349c37f7566ef90c82381a81bfb6e0b3b6afe1b6d3646be9129b5c6e785c
SSDEEP 393216:h8enxSqMKIW7y1a8YmO5RzJ/WIczzoGw+J4rV:h/nxSq77y1a/5RFW8h/
TLSH
T189D7E7113B9BA8ADD55AC87083464A631E2130DB1A36B9FF84D496353F7EAF46B3C314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48261824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

devlanes.pdb

bcryptprimitives

ProcessPrng

kernel32

GetCurrentProcessId SetLastError ReadConsoleW LockFileEx UnlockFile FlushFileBuffers GetCurrentProcess CreateToolhelp32Snapshot SetFileInformationByHandle GetProcAddress WaitForSingleObjectEx GlobalMemoryStatusEx GetSystemTimes RtlCaptureContext RtlLookupFunctionEntry QueryInformationJobObject GetProcessInformation GetPriorityClass SetPriorityClass SetProcessInformation ClosePseudoConsole OpenProcess IsProcessInJob RtlVirtualUnwind GetCurrentThread lstrlenW DuplicateHandle GetProcessTimes WriteConsoleW SetNamedPipeHandleState GetSystemInfo GetConsoleWindow TerminateJobObject CloseHandle GetDynamicTimeZoneInformation FreeConsole AttachConsole GenerateConsoleCtrlEvent WideCharToMultiByte LoadLibraryA QueryFullProcessImageNameW CreateMutexA Process32FirstW Process32NextW GetFileInformationByHandle ReleaseMutex GetModuleHandleW LoadLibraryExW VirtualProtect IsProcessorFeaturePresent FreeLibraryAndExitThread GetConsoleCP SetStdHandle GetFileType PostQueuedCompletionStatus GetFileInformationByHandleEx GetExitCodeProcess WaitForSingleObject GetSystemDirectoryW SetConsoleCtrlHandler ExitThread InitializeCriticalSectionEx FlsGetValue GetSystemTimePreciseAsFileTime CancelIoEx LocalFree ReadConsoleInputW CreateFileW CreateSemaphoreW CreateConsoleScreenBuffer CreateDirectoryW GetNumberOfConsoleInputEvents CreateNamedPipeW DeleteProcThreadAttributeList CreateJobObjectW SetInformationJobObject CreatePseudoConsole ResizePseudoConsole UpdateProcThreadAttribute InitializeSListHead GetStartupInfoW MapViewOfFile CreatePipe InitializeProcThreadAttributeList SetFilePointerEx CreateMemoryResourceNotification QueryMemoryResourceNotification UnmapViewOfFile ReadFileEx SleepEx ReleaseSemaphore GetBinaryTypeW ConnectNamedPipe ReadFile GetOverlappedResult WriteFile CreateIoCompletionPort GetLastError Sleep GetQueuedCompletionStatusEx GetModuleHandleA GetProcessHeap HeapFree SetFileCompletionNotificationModes HeapReAlloc GetStdHandle GetConsoleMode CancelIo ReadDirectoryChangesW WriteFileEx SetConsoleMode GetFullPathNameW SetConsoleTextAttribute GetCurrentThreadId CopyFileExW CreateHardLinkW GetConsoleScreenBufferInfo SetHandleInformation CreateEventW FindClose CreateThread SwitchToThread SetFileTime GetWindowsDirectoryW SetThreadStackGuarantee SetConsoleCursorPosition RemoveDirectoryW SetFileAttributesW MoveFileExW FindFirstFileExW ExitProcess GetFinalPathNameByHandleW SetConsoleCursorInfo DeleteFileW HeapAlloc GetModuleFileNameW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW IsThreadAFiber FlsSetValue FillConsoleOutputCharacterA GetTempPathW FillConsoleOutputAttribute FindNextFileW RegisterWaitForSingleObject UnregisterWaitEx GetTickCount CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize HeapDestroy HeapCompact LoadLibraryW GetNativeSystemInfo DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetConsoleActiveScreenBuffer WaitForMultipleObjects TerminateProcess CreateProcessW GetCPInfo GetOEMCP GetACP IsValidCodePage LCMapStringW GetStringTypeW GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA EncodePointer RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter CompareStringW RaiseException OutputDebugStringA OutputDebugStringW SystemTimeToFileTime FormatMessageA QueryPerformanceFrequency FormatMessageW MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW GetCurrentDirectoryW AddVectoredExceptionHandler CompareStringOrdinal QueryPerformanceCounter SetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtQuerySystemInformation NtCreateFile RtlNtStatusToDosError NtCreateNamedPipeFile NtSuspendProcess NtResumeProcess NtOpenFile NtWriteFile NtReadFile NtQueryInformationProcess

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

user32

GetUserObjectInformationW EnumWindows GetProcessWindowStation DispatchMessageW PostMessageW TranslateMessage GetKeyboardLayout ToUnicodeEx GetMessageW GetForegroundWindow IsWindowVisible GetWindowThreadProcessId SendMessageTimeoutW RegisterClassW CreateWindowExW PostQuitMessage DestroyWindow DefWindowProcW

ws2_32

connect WSAIoctl sendto recv WSASend send getaddrinfo recvfrom getsockopt WSASocketW getsockname getpeername listen bind shutdown accept WSAGetLastError WSAStartup freeaddrinfo ioctlsocket setsockopt closesocket

advapi32

GetLengthSid RegGetValueW GetSecurityDescriptorDacl RegDeleteKeyValueW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken GetTokenInformation SetSecurityInfo GetAce GetAclInformation RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegEnumKeyExW GetSecurityInfo IsValidSid SystemFunction036

crypt32

CertCloseStore CertGetCertificateContextProperty CertVerifyTimeValidity CertOpenStore CertAddEncodedCertificateToStore CertDeleteCertificateFromStore CertEnumCertificatesInStore CertFreeCertificateContext CertFindCertificateInStore CertGetEnhancedKeyUsage

iphlpapi

GetExtendedTcpTable

ole32

CoUninitialize CoInitializeEx

shell32

ShellExecuteExW

psapi

GetProcessMemoryInfo

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

Name

.text

Size

46.7MB

Virtual Size

46.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.6MB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom

bcryptprimitives

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

user32

ws2_32

advapi32

crypt32

iphlpapi

ole32

shell32

psapi

bcrypt

userenv

generic