2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
Size 1.5MB
Sample260731-df49dsbf69
SHA256 1ce26b06c49476461d900c1d07098b6c985893e0332f2cbbbbd045de832200ce
MD5 6f7e417124110932b54ab7afa6a2d689
SHA1 ce448e5ded99581c354e6460f94ae8d378c562ff
SHA512 4c8aeadf239f98245cc1191fae46fb4aeea842734574ed819b045bc1191bc801a0e8c93a9731e5dcd236b4eb85bd0cc08f422870c980b3ba9e950e8384953e64
SSDEEP 24576:77Gzs4LjZVsghsoY0OE/6vk84yis93wEsk+RzNN:7JgjZVs0sxTEic84xUs7dNN
TLSH
T141757B03F69884E8C45EC07CC7169636EA76B88D0A31B6EF27D41B253E66FA06F1D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

File Explorer

2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

.exe 1.5MB

2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

IMPHASH f33b9a5e4ab892f6584076aadc7cd00d
SHA256 1ce26b06c49476461d900c1d07098b6c985893e0332f2cbbbbd045de832200ce
MD5 6f7e417124110932b54ab7afa6a2d689
SHA1 ce448e5ded99581c354e6460f94ae8d378c562ff
SHA512 4c8aeadf239f98245cc1191fae46fb4aeea842734574ed819b045bc1191bc801a0e8c93a9731e5dcd236b4eb85bd0cc08f422870c980b3ba9e950e8384953e64
SSDEEP 24576:77Gzs4LjZVsghsoY0OE/6vk84yis93wEsk+RzNN:7JgjZVs0sxTEic84xUs7dNN
TLSH
T141757B03F69884E8C45EC07CC7169636EA76B88D0A31B6EF27D41B253E66FA06F1D354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

985116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rainvisuals_launcher.pdb

bcryptprimitives

ProcessPrng

kernel32

CreateFileW PostQueuedCompletionStatus ReadFile GetModuleHandleW GetProcAddress GetOverlappedResult SetLastError HeapReAlloc GetCurrentThread GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA GetCurrentProcess GetCurrentProcessId CreateMutexA ReleaseMutex SetThreadStackGuarantee DeleteFileW CreateDirectoryW GetFullPathNameW SetFileTime GetFileInformationByHandle GetExitCodeProcess SetFilePointerEx GetModuleHandleA WaitForSingleObject TerminateProcess SetHandleInformation CreateThread WriteFileEx SleepEx ReadFileEx CreateWaitableTimerExW SetWaitableTimer Sleep GetFinalPathNameByHandleW CreateEventW CancelIo GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle WaitForMultipleObjects IsProcessorFeaturePresent GetSystemTimeAsFileTime FindClose FindNextFileW FindFirstFileExW GetQueuedCompletionStatusEx WriteFile CreateIoCompletionPort AllocConsole SetFileCompletionNotificationModes SetFileAttributesW lstrlenW GetStdHandle GetConsoleMode WideCharToMultiByte IsDebuggerPresent WriteConsoleW CompareStringOrdinal AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetConsoleOutputCP MultiByteToWideChar GetEnvironmentVariableW ReadConsoleW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW SwitchToThread SetFileInformationByHandle UnhandledExceptionFilter GetFileInformationByHandleEx FormatMessageW GetLastError SetUnhandledExceptionFilter HeapAlloc HeapFree GetProcessHeap CloseHandle CancelIoEx ExitProcess InitializeSListHead

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

ntdll

NtOpenFile RtlNtStatusToDosError NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtCreateNamedPipeFile NtWriteFile NtReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSASocketW setsockopt bind send freeaddrinfo WSAIoctl WSACleanup recv WSASend getsockname getpeername closesocket getsockopt select connect WSAGetLastError ioctlsocket WSAStartup shutdown getaddrinfo

crypt32

CertVerifyCertificateChainPolicy CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateStore CertFreeCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore CertOpenStore

secur32

DeleteSecurityContext EncryptMessage DecryptMessage AcceptSecurityContext QueryContextAttributesW AcquireCredentialsHandleA InitializeSecurityContextW ApplyControlToken FreeContextBuffer FreeCredentialsHandle

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

vcruntime140

memset __CxxFrameHandler3 __current_exception_context __current_exception memcpy __C_specific_handler memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _initterm _configure_narrow_argv _initterm_e _exit _register_onexit_function _set_app_type __p___argc _seh_filter_exe __p___argv _cexit _initialize_onexit_table _c_exit _register_thread_local_exe_atexit_callback _wassert exit terminate

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_6f7e417124110932b54ab7afa6a2d689_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

bcryptprimitives

kernel32

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

secur32

shell32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic