2026-07-15_e527b9fc3a1872f41bf159955d22ac64_akira_cobalt-strike_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_e527b9fc3a1872f41bf159955d22ac64_akira_cobalt-strike_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk_satacom
Size 9.0MB
Sample260715-naplvsd131
SHA256 4a88b075c23145d59c252eb543714837d044e63687ed1efe876a3614f152b79d
MD5 e527b9fc3a1872f41bf159955d22ac64
SHA1 f5a73e678257e7c0f0453e7959ce4a0a4aabdf38
SHA512 225826685e794745d3f68bee371756f029d2bec33212c2b2fd2fb941a2681f8d730d4d2feba97a0c869f229fcb20d474982acdd95d72d428dfbdeab27ec642f5
SSDEEP 98304:9t1nvAmnNAhFHDKtXWMKz2z7Nzs80hyLY+oQ8HhgKn9mWQVVo:9FAatXO+YvzmWQf
TLSH
T1AF9638217A9A99ECC55AC874C34A8A735E6130CB0B36B9FF44C446393E69AF16F3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_e527b9fc3a1872f41bf159955d22ac64_akira_cobalt-strike_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk_satacom

File Explorer

2026-07-15_e527b9fc3a1872f41bf159955d22ac64_akira_cobalt-strike_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk_satacom

.exe 9.0MB

2026-07-15_e527b9fc3a1872f41bf159955d22ac64_akira_cobalt-strike_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk_satacom

IMPHASH 094fb5e8876d9603cb9646c9dee9c2c1
SHA256 4a88b075c23145d59c252eb543714837d044e63687ed1efe876a3614f152b79d
MD5 e527b9fc3a1872f41bf159955d22ac64
SHA1 f5a73e678257e7c0f0453e7959ce4a0a4aabdf38
SHA512 225826685e794745d3f68bee371756f029d2bec33212c2b2fd2fb941a2681f8d730d4d2feba97a0c869f229fcb20d474982acdd95d72d428dfbdeab27ec642f5
SSDEEP 98304:9t1nvAmnNAhFHDKtXWMKz2z7Nzs80hyLY+oQ8HhgKn9mWQVVo:9FAatXO+YvzmWQf
TLSH
T1AF9638217A9A99ECC55AC874C34A8A735E6130CB0B36B9FF44C446393E69AF16F3C354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6183136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_windows_sandbox_setup.pdb

kernel32

AddVectoredExceptionHandler CancelIoEx CloseHandle CompareStringOrdinal CompareStringW CreateDirectoryW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar OpenMutexW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx SwitchToThread TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

advapi32

BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid EqualSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSecurityInfo LookupAccountNameW LookupAccountSidW MapGenericMask RegCloseKey RegCreateKeyExW RegCreateKeyTransactedW RegOpenKeyExW RegOpenKeyTransactedW RegQueryValueExW RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW SystemFunction036

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

oleaut32

GetErrorInfo SysAllocStringLen SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetEnhancedKeyUsage CertOpenStore CertVerifyCertificateChainPolicy CertVerifyTimeValidity CryptProtectData CryptStringToBinaryA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

user32

GetSystemMetrics

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

fwpuclnt

FwpmEngineClose0 FwpmEngineOpen0 FwpmFilterAdd0 FwpmFilterDeleteByKey0 FwpmProviderAdd0 FwpmSubLayerAdd0 FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmTransactionCommit0

netapi32

NetLocalGroupAdd NetLocalGroupAddMembers NetUserAdd NetUserSetInfo

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

553B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_e527b9fc3a1872f41bf159955d22ac64_akira_cobalt-strike_glassworm_icedid_megazord_quasar-rat_rusty-stealer_ryuk_satacom

kernel32

advapi32

ntdll

oleaut32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

secur32

bcrypt

crypt32

ole32

user32

ws2_32

fwpuclnt

netapi32

generic