2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_helldown_poet-rat_quasar-rat_remcos_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_helldown_poet-rat_quasar-rat_remcos_rusty-stealer_satacom
Size 89.5MB
Sample260709-a8cs3abs3q
SHA256 57d2049d0019ec2ad03623fc15a3e6472a37097126b33388c26eaecf626149ef
MD5 200f69d6ed866649a430af430603b66f
SHA1 38a5989de6d5bf5862a6ccbebcfc3083ce87f348
SHA512 f3590f4f0db955f28a3a0060a3c11d51f7c25e66c3cdc11c3b205cad38e83ab66c0fbe9c9a9bdb9b50c86458c6fffe6a68e98ef2c32a13276485c15683e30896
SSDEEP 1572864:SH8w2TDNLyQQFwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFh8a83twzqpK:bDNL4P9
TLSH
T1F6287C4BF2A350ECC52BC470426BAB72FA20785D41246E7B57D4DB302F62F905B2AF65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_helldown_poet-rat_quasar-rat_remcos_rusty-stealer_satacom

File Explorer

2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_helldown_poet-rat_quasar-rat_remcos_rusty-stealer_satacom

.exe 89.5MB

2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_helldown_poet-rat_quasar-rat_remcos_rusty-stealer_satacom

SHA256 57d2049d0019ec2ad03623fc15a3e6472a37097126b33388c26eaecf626149ef
MD5 200f69d6ed866649a430af430603b66f
SHA1 38a5989de6d5bf5862a6ccbebcfc3083ce87f348
SHA512 f3590f4f0db955f28a3a0060a3c11d51f7c25e66c3cdc11c3b205cad38e83ab66c0fbe9c9a9bdb9b50c86458c6fffe6a68e98ef2c32a13276485c15683e30896
SSDEEP 1572864:SH8w2TDNLyQQFwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFh8a83twzqpK:bDNL4P9
TLSH
T1F6287C4BF2A350ECC52BC470426BAB72FA20785D41246E7B57D4DB302F62F905B2AF65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Enigma
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

773664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

762KB

Virtual Size

761KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

267KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.enigma1

Size

87.5MB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

756KB

Virtual Size

756KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_200f69d6ed866649a430af430603b66f_akira_bazarloader_cobalt-strike_coinminer_glassworm_helldown_poet-rat_quasar-rat_remcos_rusty-stealer_satacom

generic