2026-07-15_2db8a51ac86192e4b851f36543e40533_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_2db8a51ac86192e4b851f36543e40533_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_ryuk_satacom
Size 1.8MB
Sample260715-ph79lsfv7w
SHA256 b0dfc04fcbaf35dc454536cedea268ad8a256e45f21a0249f3253a16cde582a1
MD5 2db8a51ac86192e4b851f36543e40533
SHA1 541d2c8725c0d2c78ecc172ee0024011382af5f5
SHA512 bbe9058ee6dbae4b7b911f1e0975addf42c8d1d43c97a4c3b88cd15add4d5ed6cb42f8b0c90bccb5c5dba569c82519b146d4b73b1c9fe1ce8466cf687ab23c1b
SSDEEP 24576:2Yc0Hq8AIM1mEBOH9G9FO1E0MEds3nm2LCntzypjLwXgrcQBLKgK52VoR:9HqFmEBOH9p1jHd5qCn9ypEbQNKoVo
TLSH
T17B858D117A5A99A8D45EC4B0C3468A636E2174C71F25B9FF80D8263A3E7AEF41F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_2db8a51ac86192e4b851f36543e40533_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_ryuk_satacom

File Explorer

2026-07-15_2db8a51ac86192e4b851f36543e40533_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_ryuk_satacom

.exe 1.8MB

2026-07-15_2db8a51ac86192e4b851f36543e40533_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_ryuk_satacom

IMPHASH 444acbf99c7614148914a5be72750197
SHA256 b0dfc04fcbaf35dc454536cedea268ad8a256e45f21a0249f3253a16cde582a1
MD5 2db8a51ac86192e4b851f36543e40533
SHA1 541d2c8725c0d2c78ecc172ee0024011382af5f5
SHA512 bbe9058ee6dbae4b7b911f1e0975addf42c8d1d43c97a4c3b88cd15add4d5ed6cb42f8b0c90bccb5c5dba569c82519b146d4b73b1c9fe1ce8466cf687ab23c1b
SSDEEP 24576:2Yc0Hq8AIM1mEBOH9G9FO1E0MEds3nm2LCntzypjLwXgrcQBLKgK52VoR:9HqFmEBOH9p1jHd5qCn9ypEbQNKoVo
TLSH
T17B858D117A5A99A8D45EC4B0C3468A636E2174C71F25B9FF80D8263A3E7AEF41F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

810864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_command_runner.pdb

kernel32

AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CloseHandle CompareStringOrdinal CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateJobObjectW CreateMutexA CreatePipe CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OpenMutexW QueryPerformanceCounter RaiseException ReadFile ReadFileEx ReleaseMutex RemoveDirectoryW ResizePseudoConsole RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SleepEx TerminateProcess UnhandledExceptionFilter UpdateProcThreadAttribute VirtualProtect WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

advapi32

AdjustTokenPrivileges ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid GetLengthSid GetSecurityInfo GetTokenInformation LookupPrivilegeValueW OpenProcessToken SetEntriesInAclW SetSecurityInfo SetTokenInformation SystemFunction036

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

combase

CoTaskMemFree

bcryptprimitives

ProcessPrng

ws2_32

WSAGetLastError closesocket getsockopt

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath

user32

CloseDesktop CreateDesktopW

Name

.text

Size

884KB

Virtual Size

883KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

310KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

225B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_2db8a51ac86192e4b851f36543e40533_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_ryuk_satacom

kernel32

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

combase

bcryptprimitives

ws2_32

bcrypt

shell32

user32

generic