2026-06-27_e08aad986c2d413d6ca2006db7bbe969_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_e08aad986c2d413d6ca2006db7bbe969_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 24.9MB
Sample260629-chtd8sb13k
SHA256 abd551f365986df7b6da327106b0ca3c1f4bc53a600143ffeb83dba9118812cd
MD5 e08aad986c2d413d6ca2006db7bbe969
SHA1 cbd729ed773e55d22be74e6a024f0378f65638dc
SHA512 c106c9795612f7dde69d922dcfcec5624851fce1bab1b98a4c0dc4ddd37030c0da6bd1ecbad5360554c8e4d882862eb0041862a9d7b88a20a3b187ddb1384ec0
SSDEEP 393216:ffmtswIvhmii8lqK6vdOBOMiqO0sPAXCLbOs04:ffmWwyhNlF6XbP6CJ
TLSH
T111476A257B9A9A6DD15BC4B083874A721A7130DB0B35B9FF448496383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-06-27_e08aad986c2d413d6ca2006db7bbe969_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

File Explorer

2026-06-27_e08aad986c2d413d6ca2006db7bbe969_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

.exe 24.9MB

2026-06-27_e08aad986c2d413d6ca2006db7bbe969_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

IMPHASH aac4f5c81f097e6ceda21e05579e80a5
SHA256 abd551f365986df7b6da327106b0ca3c1f4bc53a600143ffeb83dba9118812cd
MD5 e08aad986c2d413d6ca2006db7bbe969
SHA1 cbd729ed773e55d22be74e6a024f0378f65638dc
SHA512 c106c9795612f7dde69d922dcfcec5624851fce1bab1b98a4c0dc4ddd37030c0da6bd1ecbad5360554c8e4d882862eb0041862a9d7b88a20a3b187ddb1384ec0
SSDEEP 393216:ffmtswIvhmii8lqK6vdOBOMiqO0sPAXCLbOs04:ffmWwyhNlF6XbP6CJ
TLSH
T111476A257B9A9A6DD15BC4B083874A721A7130DB0B35B9FF448496383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

af:3e:ff:e3:a1:92:07:27:fa:b0:84:45:a0:e4:f7:66:e2:48:5c:bd:87:81:e1:eb:59:4e:90:19:90:22:db:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=16728944,CN=Lezah Limited,O=Lezah Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jan 1, 0001

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

SERIALNUMBER=16728944,CN=Lezah Limited,O=Lezah Limited,L=London,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

05:56:44:1c:fd:d6:aa:7a:25:82:88:b0:36:8a:ff:3a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 7, 2026 - Jul 9, 2027

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

11767256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

retrac.pdb

user32

SetWindowPlacement DefWindowProcW GetMessageW IsIconic EnumChildWindows DispatchMessageA GetMessageA AdjustWindowRect CreateWindowExW FindWindowW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo FlashWindowEx GetWindowPlacement IsWindow GetForegroundWindow DestroyMenu CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable GetMenuItemInfoW DrawIconEx SetWindowPos AdjustWindowRectEx SetMenu CreateIcon ToUnicodeEx GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW SystemParametersInfoA SetPropW GetKeyboardLayout PostMessageW LoadCursorW GetMenu IsWindowVisible SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor DestroyIcon GetRawInputData EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow DispatchMessageW TranslateMessage SendMessageW PeekMessageW RegisterRawInputDevices ReleaseCapture PostThreadMessageW GetCursorPos SetCursor SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA GetSystemMetrics SetParent MapWindowPoints GetWindow SetFocus ShowWindow SystemParametersInfoW GetClientRect ReleaseDC GetWindowRect GetParent FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled IsProcessDPIAware GetDC GetWindowLongW TranslateAcceleratorW SetWindowLongPtrW GetWindowLongPtrW RegisterTouchWindow GetActiveWindow UpdateWindow InvalidateRect InvalidateRgn ChangeDisplaySettingsExW MapVirtualKeyW RegisterClassExW GetUpdateRect ValidateRect GetMonitorInfoW MonitorFromWindow CloseTouchInputHandle GetTouchInputInfo RedrawWindow TrackMouseEvent FillRect MonitorFromRect ClientToScreen ScreenToClient SetCursorPos DrawMenuBar DestroyWindow

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

advapi32

RegGetValueW OpenProcessToken GetTokenInformation CopySid GetLengthSid IsValidSid EventSetInformation SystemFunction036 RegCloseKey RegQueryValueExW RegSetValueExW RegDeleteTreeW RegCreateKeyExW RegOpenKeyTransactedW RegOpenKeyExW RegCreateKeyTransactedW EventUnregister EventRegister EventWriteTransfer

shell32

DragFinish DragQueryFileW SHGetKnownFolderPath CommandLineToArgvW ILFree ShellExecuteExW SHOpenFolderAndSelectItems SHAppBarMessage SHCreateItemFromParsingName ILCreateFromPathW ShellExecuteW

kernel32

GetProcessTimes GetConsoleMode LocalFree VirtualQueryEx GlobalMemoryStatusEx GetCurrentProcessId FormatMessageW FreeLibrary LoadLibraryA GetVersionExW GetModuleFileNameW GetProcAddress GetSystemInfo LCIDToLocaleName GetExitCodeProcess FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetSystemTimes QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar CancelIo GetUserDefaultUILanguage QueryPerformanceFrequency SleepEx ReadFileEx WaitForMultipleObjects ExitProcess GetTempPathW Sleep GetModuleHandleA GetFullPathNameW SetEnvironmentVariableW FindClose FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW SwitchToThread GetCurrentThreadId GetFileInformationByHandleEx CreateSymbolicLinkW CreateDirectoryW CopyFileExW RemoveDirectoryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW GetModuleHandleW ReleaseMutex SetLastError GetProcessIoCounters OutputDebugStringW LoadLibraryExW GetFileInformationByHandle HeapFree ReadProcessMemory GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetEnvironmentVariableW DuplicateHandle FlushFileBuffers SetFileInformationByHandle SetFilePointerEx CreateMutexA WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess HeapAlloc HeapReAlloc GetProcessHeap SetFileCompletionNotificationModes WaitForSingleObject OpenProcess GetFileAttributesW EncodePointer ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable CloseHandle GetLastError SleepConditionVariableSRW GetSystemTimeAsFileTime CreateProcessW CreateMutexW MoveFileExW GetQueuedCompletionStatusEx RtlPcToFileHeader CreateEventW CreateFileW DeviceIoControl K32GetPerformanceInfo RaiseException FlsAlloc FlsGetValue RtlVirtualUnwind FlsSetValue FlsFree InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx LoadLibraryExA SetHandleInformation PostQueuedCompletionStatus GetOverlappedResult ReadFile CreateIoCompletionPort InitializeCriticalSectionEx lstrlenW OutputDebugStringA LoadLibraryW DeleteCriticalSection

ole32

CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoInitialize CoTaskMemFree CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket RegisterDragDrop OleInitialize RevokeDragDrop

shlwapi

SHCreateMemStream

oleaut32

SetErrorInfo GetErrorInfo SysAllocStringLen SysFreeString SysStringLen

ntdll

NtQuerySystemInformation RtlGetVersion NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateNamedPipeFile NtWriteFile NtCreateFile NtOpenFile NtQueryInformationProcess NtReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

gdi32

DeleteDC SelectObject CombineRgn BitBlt CreateRectRgn SetBkMode GetDeviceCaps SetTextColor DeleteObject CreateSolidBrush CreateCompatibleDC CreateDIBSection

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

bcryptprimitives

ProcessPrng

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

pdh

PdhCollectQueryData PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhRemoveCounter PdhOpenQueryA PdhCloseQuery

powrprof

CallNtPowerInformation

secur32

FreeContextBuffer InitializeSecurityContextW QueryContextAttributesW AcceptSecurityContext DeleteSecurityContext DecryptMessage FreeCredentialsHandle ApplyControlToken EncryptMessage AcquireCredentialsHandleA

psapi

GetProcessMemoryInfo GetModuleFileNameExW

ws2_32

getaddrinfo WSAStartup WSAGetLastError WSACleanup freeaddrinfo closesocket shutdown bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv getpeername getsockname getsockopt

crypt32

CertAddCertificateContextToStore CertDuplicateStore CertDuplicateCertificateChain CertFreeCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertEnumCertificatesInStore

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

roundf ceil trunc __setusermatherr floor round pow

api-ms-win-crt-string-l1-1-0

strcpy_s strlen wcscmp wcslen wcsncat _wcsicmp

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _seh_filter_exe _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit terminate _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback abort _set_app_type _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

647KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_e08aad986c2d413d6ca2006db7bbe969_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

PE Signature issue

user32

comctl32

advapi32

shell32

kernel32

ole32

shlwapi

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

gdi32

dwmapi

bcryptprimitives

version

pdh

powrprof

secur32

psapi

ws2_32

crypt32

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic