2026-07-14_f4192828807d6fb0c57dc08b892c0dc8_akira_cobalt-strike_glassworm_icedid_njrat_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_f4192828807d6fb0c57dc08b892c0dc8_akira_cobalt-strike_glassworm_icedid_njrat_quasar-rat_rusty-stealer_satacom
Size 12.5MB
Sample260714-c79graez2x
SHA256 d61551e7436dcfe0e032876b7633d6fbd8ce4399bbbc677b50ab22b3e35cb5b0
MD5 f4192828807d6fb0c57dc08b892c0dc8
SHA1 b373ce96784c5080f9abc0778227737626b7e82e
SHA512 ad0945962baa22bf34af9d3f84cdf01473cd373d0a3740cc6b6923cd3189ad4a002a61ac6584d0ff351a51e93fb0fa6515e36e15435af47d658faae65e213885
SSDEEP 98304:gjz3T7tGc/gVP7A9rN8WhrY2zheYZA2Prdpr+Z9ukU2vzIZ7wXiqYuvOM:at59rOWBYOiqrrwEisZUX/EM
TLSH
T1DBD63C023E894DA9C199C874C24E9B934E2234DF193DB1EF4DA659A93F395F51F2C388
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-14_f4192828807d6fb0c57dc08b892c0dc8_akira_cobalt-strike_glassworm_icedid_njrat_quasar-rat_rusty-stealer_satacom

.exe 12.5MB

2026-07-14_f4192828807d6fb0c57dc08b892c0dc8_akira_cobalt-strike_glassworm_icedid_njrat_quasar-rat_rusty-stealer_satacom

IMPHASH fa38fd16d7f5be013f139ebc92b8072c
SHA256 d61551e7436dcfe0e032876b7633d6fbd8ce4399bbbc677b50ab22b3e35cb5b0
MD5 f4192828807d6fb0c57dc08b892c0dc8
SHA1 b373ce96784c5080f9abc0778227737626b7e82e
SHA512 ad0945962baa22bf34af9d3f84cdf01473cd373d0a3740cc6b6923cd3189ad4a002a61ac6584d0ff351a51e93fb0fa6515e36e15435af47d658faae65e213885
SSDEEP 98304:gjz3T7tGc/gVP7A9rN8WhrY2zheYZA2Prdpr+Z9ukU2vzIZ7wXiqYuvOM:at59rOWBYOiqrrwEisZUX/EM
TLSH
T1DBD63C023E894DA9C199C874C24E9B934E2234DF193DB1EF4DA659A93F395F51F2C388
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d8:23:86:ab:1a:33:04:34:7a:81:19:ad:1a:b6:0f:5d:6b:9a:1e:e2:ff:a2:f2:26:d9:a7:75:17:b2:8c:4c:21

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=PDQ.com Corporation,O=PDQ.com Corporation,L=South Salt Lake,ST=Utah,C=US

Chains

Jun 15, 2026

CN=PDQ.com Corporation,O=PDQ.com Corporation,L=South Salt Lake,ST=Utah,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=PDQ.com Corporation,O=PDQ.com Corporation,L=South Salt Lake,ST=Utah,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=PDQ.com Corporation,O=PDQ.com Corporation,L=South Salt Lake,ST=Utah,C=US

Serial Number

0f:53:5b:51:65:f7:ec:05:1f:32:ae:bc:51:13:94:a8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2025 - Sep 21, 2028

Minor OS version

Major OS version

Entry point

8108992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pdq_connect_agent.pdb

kernel32

GetSystemTimes GetProcessIoCounters FlsSetValue HeapAlloc FlsGetValue VirtualQueryEx FlsAlloc ReadProcessMemory GetProcessHeap OpenProcess GetProcessTimes GlobalMemoryStatusEx K32GetPerformanceInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead FindNextFileW FreeLibrary VirtualQuery GetStringTypeW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile FreeLibraryAndExitThread SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId TerminateProcess GetModuleHandleExW GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW SleepEx ReadFileEx HeapFree LoadLibraryExA CreateThread FlsFree EncodePointer SystemTimeToFileTime GetTimeZoneInformationForYear GetTimeZoneInformation Sleep GetLastError GetConsoleOutputCP WriteConsoleW QueryPerformanceFrequency ExitProcess GetModuleFileNameW InitializeCriticalSectionEx SetEnvironmentVariableW ExitThread LoadLibraryExW GetFileType SetConsoleCtrlHandler FindClose FindFirstFileExW GetFileInformationByHandle IsProcessorFeaturePresent GetModuleHandleA GetModuleHandleW LoadLibraryW SetNamedPipeHandleState RegisterWaitForSingleObject GetCommandLineA IsDebuggerPresent UnhandledExceptionFilter VirtualProtect InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleW GetCPInfo GetNativeSystemInfo GetSystemInfo WriteFile WaitForSingleObject GetOEMCP GetACP CreateSemaphoreA IsValidCodePage ReadFile SetLastError LCMapStringW CompareStringW GetExitCodeProcess SetHandleInformation SwitchToThread LocalFree GetFileInformationByHandleEx DeviceIoControl CreateSymbolicLinkW GetFinalPathNameByHandleW MultiByteToWideChar CreatePipe GetComputerNameExW CreateMutexA DuplicateHandle UnregisterWaitEx CreateDirectoryW MoveFileExW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetFileSizeEx SetFileTime SetFileInformationByHandle SetFilePointerEx GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx lstrlenW ReleaseMutex WideCharToMultiByte SetStdHandle SetFileCompletionNotificationModes RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetOverlappedResult CancelIoEx GetProcAddress GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCurrentProcess ReleaseSemaphore GetFullPathNameA CloseHandle

bcryptprimitives

ProcessPrng

user32

GetSystemMetrics MessageBoxA

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

psapi

GetModuleFileNameExW GetProcessMemoryInfo GetModuleInformation EnumProcessModules

advapi32

LookupAccountSidW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW DeregisterEventSource ReportEventA RegisterEventSourceA RegCloseKey RegOpenKeyExW RegQueryValueExW LookupPrivilegeValueW AddAce EqualSid GetAclInformation IsValidAcl IsValidSid GetAce InitializeAcl AddAccessDeniedAceEx AddMandatoryAce AddAuditAccessAceEx AddAccessAllowedAceEx SetNamedSecurityInfoW SetSecurityInfo GetNamedSecurityInfoW DuplicateTokenEx GetSecurityInfo CopySid CreateProcessAsUserW GetLengthSid ConvertStringSidToSidW ConvertSidToStringSidW AdjustTokenPrivileges GetTokenInformation OpenProcessToken

wevtapi

EvtSubscribe EvtRender

secur32

FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW DecryptMessage ApplyControlToken FreeCredentialsHandle DeleteSecurityContext LsaEnumerateLogonSessions LsaGetLogonSessionData AcquireCredentialsHandleA LsaFreeReturnBuffer QueryContextAttributesW EncryptMessage

ntdll

RtlGetVersion NtWriteFile NtOpenFile NtCancelIoFileEx NtQuerySystemInformation NtReadFile NtCreateNamedPipeFile NtDeviceIoControlFile NtCreateFile RtlNtStatusToDosError NtQueryInformationProcess

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

netapi32

NetApiBufferFree NetUserGetInfo NetUserEnum

pdh

PdhEnumObjectsW PdhCollectQueryData PdhCloseQuery PdhAddEnglishCounterW PdhOpenQueryW PdhGetFormattedCounterValue PdhRemoveCounter

powrprof

CallNtPowerInformation

shell32

CommandLineToArgvW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

combase

CoIncrementMTAUsage

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

GetErrorInfo SysFreeString SysStringLen

ws2_32

WSACleanup WSAStartup freeaddrinfo getaddrinfo socket getsockname setsockopt WSASend ioctlsocket WSAIoctl bind recv send WSASocketW connect getpeername shutdown getsockopt WSAGetLastError closesocket

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateChain CertDuplicateStore CertDuplicateCertificateContext CertSetCertificateContextProperty CertOpenStore CertAddEncodedCertificateToStore CertCloseStore CertFreeCertificateContext CertFreeCertificateChainEngine CertFreeCertificateChain CertCreateCertificateChainEngine CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore

Name

.text

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

598KB

Virtual Size

597KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_f4192828807d6fb0c57dc08b892c0dc8_akira_cobalt-strike_glassworm_icedid_njrat_quasar-rat_rusty-stealer_satacom

kernel32

bcryptprimitives

user32

api-ms-win-core-synch-l1-2-0

psapi

advapi32

wevtapi

secur32

ntdll

wtsapi32

userenv

netapi32

pdh

powrprof

shell32

version

combase

api-ms-win-core-winrt-l1-1-0

oleaut32

ws2_32

crypt32

generic