2026-08-04_30b5c9210c6544fd84dde98f86031980_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_30b5c9210c6544fd84dde98f86031980_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_satacom_vidar
Size 6.4MB
Sample260804-jpl23afe94
SHA256 19da4f373ef4d4f6b2deb1f033294e7a27ca4059b5cda1eb6206489e99853be4
MD5 30b5c9210c6544fd84dde98f86031980
SHA1 b50f3f07460e33adf901baf24aeca294204af896
SHA512 7118ebc38e4e121e51fc1f57b8fbe0f3317c72dfd1c8b82456be963b791a017351da057463fa6c9178c53d93d82f53e044ea256456af61b568ec834dc9b7f126
SSDEEP 98304:aV6xJn0AsDSkVmBbb9WHkelG1HPTq/gQkkMNIAUHluvlKuu1n+:/0tukgBfYEelcPTQgbk6ItYlKuul
TLSH
T14066D003F69586E9C09DC078C3569233BF76F8894B24B3EB5BD44A212E66F905F5C788
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_30b5c9210c6544fd84dde98f86031980_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_satacom_vidar

File Explorer

2026-08-04_30b5c9210c6544fd84dde98f86031980_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_satacom_vidar

.exe 6.4MB

2026-08-04_30b5c9210c6544fd84dde98f86031980_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_satacom_vidar

IMPHASH 8f181f7f402179b980ebbf4efb061cb9
SHA256 19da4f373ef4d4f6b2deb1f033294e7a27ca4059b5cda1eb6206489e99853be4
MD5 30b5c9210c6544fd84dde98f86031980
SHA1 b50f3f07460e33adf901baf24aeca294204af896
SHA512 7118ebc38e4e121e51fc1f57b8fbe0f3317c72dfd1c8b82456be963b791a017351da057463fa6c9178c53d93d82f53e044ea256456af61b568ec834dc9b7f126
SSDEEP 98304:aV6xJn0AsDSkVmBbb9WHkelG1HPTq/gQkkMNIAUHluvlKuu1n+:/0tukgBfYEelcPTQgbk6ItYlKuul
TLSH
T14066D003F69586E9C09DC078C3569233BF76F8894B24B3EB5BD44A212E66F905F5C788
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2190796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sep_updater.pdb

kernel32

CreateThread WriteFileEx SleepEx ReadFileEx GetSystemTimePreciseAsFileTime GetSystemInfo CreateWaitableTimerExW SetWaitableTimer GetExitCodeProcess GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle GetTickCount64 GlobalMemoryStatusEx GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW DeviceIoControl OpenProcess WaitForSingleObjectEx GetCurrentThreadId GetProcessTimes GetSystemTimes GetProcessIoCounters WriteConsoleW GetLogicalDrives GetConsoleOutputCP LocalFree VirtualQueryEx SwitchToThread GetCurrentProcessId SetHandleInformation PostQueuedCompletionStatus TerminateProcess UnregisterWaitEx SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree FindNextFileW HeapReAlloc GetConsoleMode SetConsoleMode GetFileInformationByHandleEx GetModuleFileNameW DeleteFileW GetFileInformationByHandle GetCurrentProcess SetFileInformationByHandle GetStdHandle FillConsoleOutputCharacterA GetModuleHandleW CreateFileW FindClose FindFirstFileExW GetFullPathNameW CreateDirectoryW CloseHandle SetFilePointerEx FlushFileBuffers HeapSize GetFileType SetStdHandle WaitForSingleObject GetLastError HeapAlloc GetConsoleWindow GetModuleHandleExW ExitProcess WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue CreateMutexA TlsGetValue RegisterWaitForSingleObject ReleaseMutex LoadLibraryA GetProcAddress GetModuleHandleA Sleep TlsAlloc SetFileCompletionNotificationModes IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime FillConsoleOutputAttribute SetConsoleCursorPosition GetConsoleScreenBufferInfo CreateIoCompletionPort SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA RtlPcToFileHeader InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer RtlUnwindEx UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead SetEnvironmentVariableW SystemTimeToTzSpecificLocalTime SystemTimeToFileTime AddVectoredExceptionHandler MultiByteToWideChar GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry GetCommandLineW lstrlenW WideCharToMultiByte RtlVirtualUnwind GetEnvironmentVariableW FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter CompareStringW LCMapStringW SetUnhandledExceptionFilter CompareStringOrdinal ReadProcessMemory FreeEnvironmentStringsW GetEnvironmentStringsW

ntdll

NtCreateNamedPipeFile NtQueryInformationProcess NtWriteFile NtOpenFile NtDeviceIoControlFile RtlGetVersion NtQuerySystemInformation NtCreateFile NtCancelIoFileEx NtReadFile RtlNtStatusToDosError

ws2_32

recv WSASend getaddrinfo send shutdown socket getsockopt setsockopt ioctlsocket freeaddrinfo WSASocketW WSAIoctl getsockname closesocket WSAGetLastError listen bind WSACleanup WSAStartup getpeername connect

secur32

DecryptMessage ApplyControlToken LsaEnumerateLogonSessions InitializeSecurityContextW LsaGetLogonSessionData LsaFreeReturnBuffer AcquireCredentialsHandleA FreeContextBuffer QueryContextAttributesW EncryptMessage DeleteSecurityContext FreeCredentialsHandle AcceptSecurityContext

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

crypt32

CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateStore CertDuplicateCertificateContext

bcrypt

BCryptGenRandom

advapi32

SystemFunction036 LookupAccountSidW CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken RegQueryValueExW RegCloseKey RegOpenKeyExW

bcryptprimitives

ProcessPrng

oleaut32

SysAllocString SysFreeString VariantClear

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfTable2

netapi32

NetUserGetInfo NetUserGetLocalGroups NetApiBufferFree NetUserEnum

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

pdh

PdhOpenQueryA PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetPerformanceInfo

shell32

CommandLineToArgvW

user32

ShowWindow

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_30b5c9210c6544fd84dde98f86031980_akira_cobalt-strike_glassworm_icedid_megazord_rusty-stealer_satacom_vidar

kernel32

ntdll

ws2_32

secur32

api-ms-win-core-synch-l1-2-0

crypt32

bcrypt

advapi32

bcryptprimitives

oleaut32

iphlpapi

netapi32

ole32

pdh

powrprof

psapi

shell32

user32

generic