2026-07-31_1f7e563a08a93e2e5cb2a45761524fdf_akira_cobalt-strike_funksec_glassworm_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_1f7e563a08a93e2e5cb2a45761524fdf_akira_cobalt-strike_funksec_glassworm_satacom_vidar
Size 8.9MB
Sample260731-phbweafp7w
SHA256 ae4c53f04a64ba1bc66f679293d9bbc6c0d3f44e0b2bcafcfa171cc5e9357f03
MD5 1f7e563a08a93e2e5cb2a45761524fdf
SHA1 93005fd49dad54da64cc4263e246ad91a974fce3
SHA512 9bd973fd1ef2c62c7157febbc1361eb703d94ebae422db82091b1465a36d959b6098455de29c42540c88fd3fd69cf22ed24c5a07a49e2d7f554cb5a6c13e7525
SSDEEP 98304:pSt+eRgwOFiDzVRL7j6BDUkQ+mnXPoxBEwAEZ/3A++qQOCe:SrO0/VIajMAI/r8e
TLSH
T14C962903F79281E9C569C0B4835A6332FAB2BC4D473476FB5FE04A212E55BA06B7CB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-31_1f7e563a08a93e2e5cb2a45761524fdf_akira_cobalt-strike_funksec_glassworm_satacom_vidar

.exe 8.9MB

2026-07-31_1f7e563a08a93e2e5cb2a45761524fdf_akira_cobalt-strike_funksec_glassworm_satacom_vidar

IMPHASH 5204292a74ba1ed2a6c9794d3ce1d8e8
SHA256 ae4c53f04a64ba1bc66f679293d9bbc6c0d3f44e0b2bcafcfa171cc5e9357f03
MD5 1f7e563a08a93e2e5cb2a45761524fdf
SHA1 93005fd49dad54da64cc4263e246ad91a974fce3
SHA512 9bd973fd1ef2c62c7157febbc1361eb703d94ebae422db82091b1465a36d959b6098455de29c42540c88fd3fd69cf22ed24c5a07a49e2d7f554cb5a6c13e7525
SSDEEP 98304:pSt+eRgwOFiDzVRL7j6BDUkQ+mnXPoxBEwAEZ/3A++qQOCe:SrO0/VIajMAI/r8e
TLSH
T14C962903F79281E9C569C0B4835A6332FAB2BC4D473476FB5FE04A212E55BA06B7CB54
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

b3:e6:26:72:92:6c:ea:d9:65:a2:ee:3c:26:e5:8c:50:46:0b:7a:62:e9:1d:58:bb:c1:10:84:84:e7:1c:45:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Secria\, Inc.,O=Secria\, Inc.,L=Dover,ST=Delaware,C=US

Chains

Jul 25, 2026

CN=Secria\, Inc.,O=Secria\, Inc.,L=Dover,ST=Delaware,C=US

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Secria\, Inc.,O=Secria\, Inc.,L=Dover,ST=Delaware,C=US

Serial Number

33:00:03:9d:2e:cb:55:48:0c:1a:13:f1:40:00:00:00:03:9d:2e

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 23, 2026 - Jul 26, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:59:7c:da:71:e9:8d:5e:f5:c0:00:00:00:00:00:59

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

7115516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wstunnel.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegOpenKeyExW SystemFunction036 RegQueryValueExW

kernel32

GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent SetUnhandledExceptionFilter TerminateProcess HeapFree SwitchToThread GetLastError QueryPerformanceCounter GetSystemTimePreciseAsFileTime HeapReAlloc PostQueuedCompletionStatus CloseHandle ReleaseSemaphore QueryPerformanceFrequency FindFirstFileW FindNextFileW FindClose GetSystemInfo GetCommandLineW SetLastError GetModuleFileNameW GetConsoleMode SetConsoleMode AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CreateFileW WaitForSingleObject GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes CreateSemaphoreW WaitForSingleObjectEx CancelIo ReadDirectoryChangesW Sleep GetModuleHandleA GetProcAddress MultiByteToWideChar WriteConsoleW CreateWaitableTimerExW SetWaitableTimer GetModuleHandleW FormatMessageW GetCurrentDirectoryW LoadLibraryA GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentVariableW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetFinalPathNameByHandleW SetFilePointerEx ReadConsoleW CreateThread ExitProcess HeapAlloc GetProcessHeap GetFileType SetHandleInformation SetConsoleCtrlHandler InitializeSListHead UnhandledExceptionFilter IsDebuggerPresent

ws2_32

WSASend recv bind getsockname WSACleanup getpeername listen freeaddrinfo getaddrinfo ioctlsocket send sendto accept socket WSASocketW setsockopt WSAGetLastError shutdown closesocket connect recvfrom WSAStartup getsockopt WSAIoctl

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

crypt32

CertVerifyTimeValidity CertDuplicateCertificateContext CertEnumCertificatesInStore CertCloseStore CertGetEnhancedKeyUsage CertOpenStore CertFreeCertificateContext

ntdll

NtWriteFile NtDeviceIoControlFile NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtReadFile

vcruntime140

memcmp __CxxFrameHandler3 memset __current_exception_context __current_exception memcpy __C_specific_handler memmove

api-ms-win-crt-math-l1-1-0

round __setusermatherr exp pow

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _get_initial_narrow_environment _seh_filter_exe _register_thread_local_exe_atexit_callback _initterm _c_exit _cexit __p___argv _initterm_e exit _exit __p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_1f7e563a08a93e2e5cb2a45761524fdf_akira_cobalt-strike_funksec_glassworm_satacom_vidar

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ws2_32

bcrypt

iphlpapi

crypt32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic