2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom

General

Target
2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom
Size 4.1MB
Sample260705-sd31wagx6j
SHA256 5f5fd8ca723da15f7d253f814d2a83d739f8f8f79e6236be3ae9b8a4a3d471d9
MD5 847718130ec6019f1829b3ac37b08469
SHA1 9bca35e5d6eb6a3ad838d35d47f2859dcd63fbfa
SHA512 9005e74b8c4d8f4207b0925c41bf4fe057fe06e88e0f84a1c01c69e0b4097fd9e9642855cab0a6ca4f7d76e577e494380799c1e73d86e12e401cdebad4d13064
SSDEEP 49152:FFaCKaQ/Z7Hy00L7jSo0+5rGBxYWmLiWwnalgK1u+AfCJU8CN6SCmYvuhVKQVfNu:FFlQk0RF1OUna+Kj8YAVVfNwV
TLSH
T1D0167C03FAA581E9D46AC038D31A9233EB72FC9D5620B69B1BD44B213F67B602F5D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom

File Explorer

2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom

.exe 4.1MB

2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom

SHA256 5f5fd8ca723da15f7d253f814d2a83d739f8f8f79e6236be3ae9b8a4a3d471d9
MD5 847718130ec6019f1829b3ac37b08469
SHA1 9bca35e5d6eb6a3ad838d35d47f2859dcd63fbfa
SHA512 9005e74b8c4d8f4207b0925c41bf4fe057fe06e88e0f84a1c01c69e0b4097fd9e9642855cab0a6ca4f7d76e577e494380799c1e73d86e12e401cdebad4d13064
SSDEEP 49152:FFaCKaQ/Z7Hy00L7jSo0+5rGBxYWmLiWwnalgK1u+AfCJU8CN6SCmYvuhVKQVfNu:FFlQk0RF1OUna+Kj8YAVVfNwV
TLSH
T1D0167C03FAA581E9D46AC038D31A9233EB72FC9D5620B69B1BD44B213F67B602F5D354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing combination of virtualization drivers
Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2871168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom

generic