2026-08-08_6f387c9158f4990cd211ceb3e5d8bc8d_akira_cobalt-strike_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_6f387c9158f4990cd211ceb3e5d8bc8d_akira_cobalt-strike_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_zxxz
Size 45.1MB
Sample260808-dx33naygrf
SHA256 3fecabdbc28fc96f2d2ca8a2ac35625f8c2f5f95443f9b152ad05c92a5973f9a
MD5 6f387c9158f4990cd211ceb3e5d8bc8d
SHA1 a272defb72824224a1f447b6620132de578aed9f
SHA512 9b39601b1e7859aef2326a92c2bdb599768bb0d18887df098911636d7406b9d63ea5f57a7023517843e1f5b09acd0bd7a0e991cca9244723105e5bc606403548
SSDEEP 393216:FKKRe3KZrAHtwirRgbKC+4oZWITSF5aGxob3EA7RVfkV0vg:FBRwKZrAHtwirkaaITk9kxvg
TLSH
T1A0A77D03F95509ADC59FD63486AE633AB73078854331ABEB1B709B311E62BC19B7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_6f387c9158f4990cd211ceb3e5d8bc8d_akira_cobalt-strike_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_zxxz

File Explorer

2026-08-08_6f387c9158f4990cd211ceb3e5d8bc8d_akira_cobalt-strike_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_zxxz

.exe 45.1MB

2026-08-08_6f387c9158f4990cd211ceb3e5d8bc8d_akira_cobalt-strike_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_zxxz

IMPHASH b35137edc3e301f5f721463d718d541c
SHA256 3fecabdbc28fc96f2d2ca8a2ac35625f8c2f5f95443f9b152ad05c92a5973f9a
MD5 6f387c9158f4990cd211ceb3e5d8bc8d
SHA1 a272defb72824224a1f447b6620132de578aed9f
SHA512 9b39601b1e7859aef2326a92c2bdb599768bb0d18887df098911636d7406b9d63ea5f57a7023517843e1f5b09acd0bd7a0e991cca9244723105e5bc606403548
SSDEEP 393216:FKKRe3KZrAHtwirRgbKC+4oZWITSF5aGxob3EA7RVfkV0vg:FBRwKZrAHtwirkaaITk9kxvg
TLSH
T1A0A77D03F95509ADC59FD63486AE633AB73078854331ABEB1B709B311E62BC19B7E314
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

SystemFunction036 RegCloseKey RegEnumKeyExW RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegGetValueA

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateHardLinkW CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW GetCommandLineW GetComputerNameExW GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetModuleFileNameW GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WideCharToMultiByte WriteConsoleW WriteFileEx GetTimeZoneInformationForYear CloseHandle GetModuleHandleA GetProcAddress Sleep DuplicateHandle GetCurrentProcess GetCurrentThreadId GetModuleHandleW GetUserDefaultUILanguage HeapFree LCIDToLocaleName LoadLibraryA LoadLibraryW RegisterWaitForSingleObject SetHandleInformation TlsGetValue TlsSetValue UnregisterWaitEx WaitForSingleObject lstrlenW FreeLibrary LoadLibraryExA FormatMessageW GetLastError GetProcessHeap HeapAlloc CancelIoEx ConnectNamedPipe CreateFileW CreateIoCompletionPort CreatePipe DisconnectNamedPipe GetConsoleMode GetConsoleScreenBufferInfo GetFileInformationByHandle GetNamedPipeInfo GetOverlappedResult GetQueuedCompletionStatusEx PostQueuedCompletionStatus ReadFile SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetFileCompletionNotificationModes SetNamedPipeHandleState WriteFile DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlGetVersion NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

wininet

InternetSetOptionW

ws2_32

GetHostNameW WSACleanup WSAStartup freeaddrinfo getaddrinfo select WSADuplicateSocketW WSAGetLastError WSAIoctl WSAPoll WSARecv WSARecvFrom WSASend WSASendMsg WSASendTo WSASocketW accept bind closesocket connect getpeername getsockname getsockopt ioctlsocket listen recv recvfrom send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

webview2loader

CreateCoreWebView2EnvironmentWithOptions GetAvailableCoreWebView2BrowserVersionString

bcryptprimitives

ProcessPrng

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject SetBkMode SetTextColor

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

ole32

CoCreateInstance CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize OleInitialize PropVariantClear PropVariantCopy RegisterDragDrop RevokeDragDrop CoCreateFreeThreadedMarshaler CoCreateGuid

oleaut32

VariantClear VariantCopy GetErrorInfo SetErrorInfo SysAllocStringLen SysFreeString SysStringLen

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64 PropVariantToVariant VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToPropVariant VariantToUInt16 VariantToUInt32 VariantToUInt64

shell32

DragFinish DragQueryFileW SHAppBarMessage SHGetKnownFolderPath ShellExecuteExW ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW ILCreateFromPathW ILFree SHOpenFolderAndSelectItems

shlwapi

SHCreateMemStream

user32

AdjustWindowRect AdjustWindowRectEx AppendMenuW ChangeDisplaySettingsExW ChangeWindowMessageFilterEx CheckMenuItem ClientToScreen ClipCursor CloseTouchInputHandle CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawIconEx DrawMenuBar DrawTextW EnableMenuItem EnableWindow EnumChildWindows EnumDisplayMonitors FillRect FindWindowExW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClientRect GetClipCursor GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMenuBarInfo GetMenuItemInfoW GetMessageA GetMessageW GetMonitorInfoW GetParent GetRawInputData GetRawInputDeviceInfoW GetSystemMenu GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindow GetWindowDC GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InsertMenuW InvalidateRect InvalidateRgn IsIconic IsProcessDPIAware IsWindow IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadImageW MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterClassW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageW SetCapture SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetTimer SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow ValidateRect VkKeyScanW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc ceil ceilf exit expf floor floorf fmod fmodf fprintf free fwrite malloc memcmp memcpy memmove memset pow signal sinf strlen strncmp vfprintf wcslen

Name

.text

Size

16.5MB

Virtual Size

16.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

17.7MB

Virtual Size

17.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

436KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_6f387c9158f4990cd211ceb3e5d8bc8d_akira_cobalt-strike_coinminer_dosia_glassworm_hive_luca-stealer_poet-rat_quasar-rat_zxxz

advapi32

bcrypt

kernel32

ntdll

userenv

wininet

ws2_32

api-ms-win-core-synch-l1-2-0

webview2loader

bcryptprimitives

comctl32

dwmapi

gdi32

imm32

ole32

oleaut32

propsys

shell32

shlwapi

user32

api-ms-win-core-winrt-error-l1-1-0

msvcrt

generic