2026-07-07_e27d47940f0805894aae21d45d858493_akira_cobalt-strike_coinminer_glassworm_megazord_poet-rat_quasar-rat_rusty-stealer_sliver_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_e27d47940f0805894aae21d45d858493_akira_cobalt-strike_coinminer_glassworm_megazord_poet-rat_quasar-rat_rusty-stealer_sliver_vidar
Size 27.5MB
Sample260707-v3cakaax21
SHA256 efc016fc48694d3e8d70981e66e06e255f50b4b09d2a59a5834058e49c77e743
MD5 e27d47940f0805894aae21d45d858493
SHA1 a3ee5d13bcceb90945627b3e469f5bcc2a84a69f
SHA512 64576f97192383d606d2cc0450a972c11b171e3e20a698b07177d961f70ff0e2fb83a0c43d89b21acd5b0b92dd40a6236e074f0cfbcaeca85643218dc5c58d9f
SSDEEP 98304:GWftYgrchQBYL+QotklmKVLl6IaiUi2PWJw479rwOT3WKwskYWn2wErpkgvqj7IO:j0vljFN3EF45rl3XPwSeITxw9jMYuO7
TLSH
T161577C12B785899DC45EC074C34676626A3074DA0FF1BAEF068497393E7AAF86F3C614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-07_e27d47940f0805894aae21d45d858493_akira_cobalt-strike_coinminer_glassworm_megazord_poet-rat_quasar-rat_rusty-stealer_sliver_vidar

.exe 27.5MB

2026-07-07_e27d47940f0805894aae21d45d858493_akira_cobalt-strike_coinminer_glassworm_megazord_poet-rat_quasar-rat_rusty-stealer_sliver_vidar

IMPHASH c8274e4219c740873f94ed146de57c56
SHA256 efc016fc48694d3e8d70981e66e06e255f50b4b09d2a59a5834058e49c77e743
MD5 e27d47940f0805894aae21d45d858493
SHA1 a3ee5d13bcceb90945627b3e469f5bcc2a84a69f
SHA512 64576f97192383d606d2cc0450a972c11b171e3e20a698b07177d961f70ff0e2fb83a0c43d89b21acd5b0b92dd40a6236e074f0cfbcaeca85643218dc5c58d9f
SSDEEP 98304:GWftYgrchQBYL+QotklmKVLl6IaiUi2PWJw479rwOT3WKwskYWn2wErpkgvqj7IO:j0vljFN3EF45rl3XPwSeITxw9jMYuO7
TLSH
T161577C12B785899DC45EC074C34676626A3074DA0FF1BAEF068497393E7AAF86F3C614
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

3d:31:38:20:68:aa:88:2f:8a:cc:35:2d:70:73:c1:0c:16:9c:5f:0f:eb:f7:1b:84:d0:07:d5:18:2b:24:6e:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=305079257,CN=Sensmetry UAB,O=Sensmetry UAB,ST=Vilniaus miestas,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

Chains

May 28, 2026

SERIALNUMBER=305079257,CN=Sensmetry UAB,O=Sensmetry UAB,ST=Vilniaus miestas,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=305079257,CN=Sensmetry UAB,O=Sensmetry UAB,ST=Vilniaus miestas,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

SERIALNUMBER=305079257,CN=Sensmetry UAB,O=Sensmetry UAB,ST=Vilniaus miestas,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

02:7c:39:01:0c:a7:5a:c3:3a:b5:ee:0d:54:0e:f9:e5

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

SERIALNUMBER=305079257,CN=Sensmetry UAB,O=Sensmetry UAB,ST=Vilniaus miestas,C=LT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024c54

Serial Number

96:78:09:fe:6c:fb:1a:8d:6a:7c:bb:45:8f:a6:f2:1d

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 20, 2025 - Feb 20, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

16983884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

syside.pdb

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf _close _dup _dup2 _filelengthi64 _fileno _fseeki64 _fsopen _fwrite_nolock _get_osfhandle _get_stream_buffer_pointers _isatty _open _open_osfhandle _pipe _read _set_fmode _wfsopen _write _wsopen_s fclose feof ferror fflush fgetc fgetpos fgets fopen fopen_s fputc fputs fread fseek fsetpos ftell fwrite setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

_Exit __p___argc __p___wargv _beginthreadex _c_exit _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _endthreadex _errno _execute_onexit_table _exit _get_initial_wide_environment _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_dll _seh_filter_exe _set_app_type _set_errno _set_invalid_parameter_handler _set_new_handler _wassert abort exit quick_exit set_terminate signal strerror strerror_s terminate

api-ms-win-crt-string-l1-1-0

__strncnt _strdup _wcsdup isalnum isalpha islower isprint isspace isupper iswctype iswspace isxdigit strcmp strcpy strcpy_s strcspn strlen strncmp strncpy strnlen strspn tolower wcslen wcsncmp wcsnlen

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlNtStatusToDosError RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

api-ms-win-crt-math-l1-1-0

__setusermatherr _dclass _dsign _dtest _fdopen _fdtest _ldclass _ldsign _ldtest acos asin atan atan2 ceil ceilf copysign cos floor frexp hypot ilogb ldexp log log10 modf nan nanf pow round scalbn sin sqrt tan

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _callnewh _set_new_mode calloc free malloc realloc

ws2_32

WSAAddressToStringW WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASetLastError WSASocketW WSAStartup WSAStringToAddressW __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt htonl inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredContinueHandler AddVectoredExceptionHandler AreFileApisANSI CancelIo CancelIoEx CloseHandle CloseThreadpoolTimer CloseThreadpoolWait CompareStringEx CompareStringOrdinal ConnectNamedPipe CopyFileExW CopyFileW CreateDirectoryExW CreateDirectoryW CreateEventA CreateEventExW CreateEventW CreateFileA CreateFileW CreateHardLinkW CreateIoCompletionPort CreateMutexA CreatePipe CreateProcessW CreateSemaphoreExW CreateSymbolicLinkW CreateThread CreateThreadpoolTimer CreateThreadpoolWait CreateWaitableTimerA CreateWaitableTimerExW DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FlushProcessWriteBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryWhenCallbackReturns GetCPInfo GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLogicalProcessorInformation GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetNamedPipeInfo GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetQueuedCompletionStatus GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetSystemWindowsDirectoryW GetTempPathW GetThreadTimes GetTickCount64 GetTimeZoneInformationForYear GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process K32GetModuleInformation LCIDToLocaleName LCMapStringEx LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalFree LockFileEx MoveFileExA MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA PeekConsoleInputA PeekNamedPipe PostQueuedCompletionStatus ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency QueueUserAPC QueueUserWorkItem RaiseException ReadConsoleA ReadConsoleW ReadFile ReadFileEx RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW RemoveVectoredContinueHandler SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetSystemFileCacheSize SetThreadDescription SetThreadStackGuarantee SetThreadpoolTimer SetThreadpoolWait SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SleepConditionVariableSRW SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared UnhandledExceptionFilter UnlockFile UnlockFileEx UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolTimerCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile WriteFileEx lstrcmpW lstrlenW

api-ms-win-crt-convert-l1-1-0

_itoa_s _ui64toa_s _ultoa_s _wtoi atol mbstowcs_s strtod strtof strtol strtoll strtoul strtoull wcstombs_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func ___mb_cur_max_func __pctype_func _configthreadlocale _lock_locales _unlock_locales localeconv setlocale

api-ms-win-crt-time-l1-1-0

_Getdays _Getmonths _Gettnames _Strftime _W_Getdays _W_Getmonths _W_Gettnames _Wcsftime __dstbias __timezone __tzname _gmtime64_s _localtime64_s _mkgmtime64 _mktime64 _time64 strftime

api-ms-win-crt-environment-l1-1-0

_dupenv_s _wgetenv getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32 _lock_file _unlock_file _waccess _wmkdir _wremove _wrename _wstat64i32

advapi32

CredDeleteW CredFree CredReadW CredWriteW CryptAcquireContextW CryptDestroyKey CryptImportKey CryptReleaseContext EqualSid GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW SystemFunction036

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

user32

wsprintfW

api-ms-win-crt-utility-l1-1-0

bsearch qsort rand_s

oleaut32

CreateErrorInfo GetErrorInfo SetErrorInfo SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantChangeType VariantClear VariantInit

dbghelp

StackWalk64 SymCleanup SymEnumSymbols SymFromAddr SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymGetTypeInfo SymInitialize SymLoadModuleEx SymSetContext SymSetOptions UnDecorateSymbolName

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

userenv

GetUserProfileDirectoryW

bcryptprimitives

ProcessPrng

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

crypt32

CertAddCertificateContextToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertCloseStore CertCreateCTLEntryFromCertificateContextProperties CertCreateCertificateContext CertDeleteCertificateFromStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertOpenStore CertSetCertificateContextProperty CertVerifyCertificateChainPolicy CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CryptBinaryToStringA CryptDecodeObjectEx CryptEncodeObjectEx CryptHashCertificate CryptMsgEncodeAndSignCTL CryptStringToBinaryA PFXExportCertStore PFXImportCertStore

ncrypt

NCryptFreeObject

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ktmw32

CommitTransaction CreateTransaction

Name

.text

Size

16.3MB

Virtual Size

16.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

671KB

Virtual Size

867KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

797KB

Virtual Size

796KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

362B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

Name

.rsrc

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_e27d47940f0805894aae21d45d858493_akira_cobalt-strike_coinminer_glassworm_megazord_poet-rat_quasar-rat_rusty-stealer_sliver_vidar

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

ws2_32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

advapi32

shell32

combase

user32

api-ms-win-crt-utility-l1-1-0

oleaut32

dbghelp

ole32

bcrypt

api-ms-win-core-synch-l1-2-0

userenv

bcryptprimitives

secur32

crypt32

ncrypt

api-ms-win-core-winrt-error-l1-1-0

ktmw32

generic