2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_quasar-rat_rusty-stealer_satacom
Size 14.8MB
Sample260806-bpswlszhpg
SHA256 1a56067d238a929db283ba356c90d73caeb35dbd03297d8c8391a2a18bc2c990
MD5 a5235fe623e2d66523ffc9824d573f43
SHA1 2186183e1703a16b2725be7045ac3d3d89d70b0c
SHA512 0aea82c8ceffc0d687d1015789d2b6c1bd4552343b051cac2a94253028dfbd3bc31b341e2ff69706e40a130bf1e53bfc4ed7edcdb8f8c909e14080982678cfa6
SSDEEP 98304:/9KfeA3sTl3guCzEic6VfHptwPfj2YiArSFg9UFr9+jvfvFviv2ELQBrvJPpyX5c:1JAc6DJMrEHrcBdoJh
TLSH
T189F65A47F95541E8C1AAD170C6259223BA703C894F3063EB6B50F7B83F36BE45A7A358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_quasar-rat_rusty-stealer_satacom

File Explorer

2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_quasar-rat_rusty-stealer_satacom

.exe 14.8MB

2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_quasar-rat_rusty-stealer_satacom

IMPHASH 3027695b78b805eb6bfc3c290afa4a80
SHA256 1a56067d238a929db283ba356c90d73caeb35dbd03297d8c8391a2a18bc2c990
MD5 a5235fe623e2d66523ffc9824d573f43
SHA1 2186183e1703a16b2725be7045ac3d3d89d70b0c
SHA512 0aea82c8ceffc0d687d1015789d2b6c1bd4552343b051cac2a94253028dfbd3bc31b341e2ff69706e40a130bf1e53bfc4ed7edcdb8f8c909e14080982678cfa6
SSDEEP 98304:/9KfeA3sTl3guCzEic6VfHptwPfj2YiArSFg9UFr9+jvfvFviv2ELQBrvJPpyX5c:1JAc6DJMrEHrcBdoJh
TLSH
T189F65A47F95541E8C1AAD170C6259223BA703C894F3063EB6B50F7B83F36BE45A7A358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2019472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FixYourExecOnline.pdb

kernel32

LoadLibraryExW GetModuleFileNameW GetLastError CloseHandle Sleep GetModuleHandleA GetProcAddress SetThreadErrorMode FreeLibrary InitializeSListHead SetUnhandledExceptionFilter GetSystemTimeAsFileTime FindNextFileW GetModuleHandleW GetFileAttributesW SetWaitableTimer GetCurrentThreadId LoadLibraryW GlobalLock GlobalAlloc SetLastError GlobalUnlock GlobalSize WideCharToMultiByte GlobalFree MultiByteToWideChar GetCurrentThread FormatMessageW GetProcessHeap HeapFree LoadLibraryA HeapAlloc WaitForSingleObject CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW FindFirstFileExW FindClose ExitProcess SwitchToThread WaitForSingleObjectEx CreateMutexA ReleaseMutex DeleteFileW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

opengl32

wglShareLists wglCreateContext wglGetCurrentDC wglGetCurrentContext wglGetProcAddress wglMakeCurrent wglDeleteContext

shlwapi

AssocQueryStringW

user32

GetSystemMetrics RegisterTouchWindow SetWindowDisplayAffinity GetClientRect SetWindowPos InvalidateRgn ReleaseDC GetWindowLongPtrW SetWindowLongPtrW DefWindowProcW RedrawWindow ChangeDisplaySettingsExW PeekMessageW GetWindowPlacement SetWindowPlacement TranslateMessage DispatchMessageW GetActiveWindow SendMessageW CreateIconFromResourceEx ValidateRect GetMenu ScreenToClient MonitorFromRect GetTouchInputInfo CloseTouchInputHandle TrackMouseEvent GetCursorPos MonitorFromWindow GetMonitorInfoW LoadCursorW SetCursor GetDC GetClassNameW GetClassInfoExW ClientToScreen SetCursorPos GetForegroundWindow FlashWindowEx EmptyClipboard OpenClipboard IsClipboardFormatAvailable CreateWindowExW SetClipboardData RegisterClipboardFormatW CloseClipboard SetPropW GetPropW CallWindowProcW RemovePropW ReleaseCapture ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongW AdjustWindowRectEx GetClipCursor ClipCursor ShowCursor RegisterWindowMessageA SetCapture SetTimer GetMessageW KillTimer GetWindowTextLengthW GetWindowTextW SetWindowTextW MonitorFromPoint EnumDisplayMonitors MapVirtualKeyW SendInput SetForegroundWindow GetRawInputData RegisterRawInputDevices GetKeyboardLayout DestroyIcon IsProcessDPIAware CreateIcon SystemParametersInfoA GetWindowRect IsIconic GetKeyState ToUnicodeEx MapVirtualKeyExW GetKeyboardState GetAsyncKeyState RegisterClassExW PostMessageW DestroyWindow GetClipboardData

shell32

DragFinish DragQueryFileW

gdi32

SetPixelFormat SwapBuffers DeleteObject ChoosePixelFormat GetDeviceCaps CreateRectRgn DescribePixelFormat

advapi32

RevertToSelf ImpersonateAnonymousToken

ole32

RegisterDragDrop RevokeDragDrop CoInitializeEx CoUninitialize CoCreateInstance OleInitialize

dwmapi

DwmEnableBlurBehindWindow

uiautomationcore

UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaLookupId UiaGetReservedNotSupportedValue

oleaut32

SysAllocStringLen SetErrorInfo SafeArrayPutElement SysStringLen SysFreeString GetErrorInfo SafeArrayCreateVector

uxtheme

SetWindowTheme

imm32

ImmGetCompositionStringW ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmAssociateContextEx

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile NtOpenFile

vcruntime140

__CxxFrameHandler3 memcpy memmove memcmp memset _CxxThrowException __current_exception_context __current_exception __C_specific_handler

api-ms-win-crt-math-l1-1-0

powf floorf _hypotf cosf atan2f exp2f expf roundf ceilf acosf cbrtf sinf floor round trunc cos __setusermatherr ceil sin

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argv _set_app_type _seh_filter_exe _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate _exit __p___argc strerror

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_a5235fe623e2d66523ffc9824d573f43_akira_cobalt-strike_coinminer_dosia_glassworm_luca-stealer_quasar-rat_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

opengl32

shlwapi

user32

shell32

gdi32

advapi32

ole32

dwmapi

uiautomationcore

oleaut32

uxtheme

imm32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic