2026-08-13_838ea66faef69d8633a3210dbb152589_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_plugx_poet-rat_pos_quasar-rat_rusty-stealer_satacom_stealc_vidar

General

Target
2026-08-13_838ea66faef69d8633a3210dbb152589_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_plugx_poet-rat_pos_quasar-rat_rusty-stealer_satacom_stealc_vidar
Size 115.1MB
Sample260813-e2bpms1gre
SHA256 8a8c65069163c42874ff227c13b57dc3c9217e7d6fc349a95e4aaef411b14fa9
MD5 838ea66faef69d8633a3210dbb152589
SHA1 ba1443777793e22c22deb8bac855032346bdbff0
SHA512 dd0c0e0ec611ddf660c7a453910b567a597ea4a8ae00fdc833350f52bf1cbbdf7937332fb20f62773e79662bd9e9ff110c2616f728bb674c66e9f23a2b28202e
SSDEEP 786432:4i8lv6zqmnQnPUj13y2dtmstgUzBAc34VmlShA1or4Ix:4i8lAqmnQPB24mlShA1246
TLSH
T103486B0113780094D492C639AE36B687CE71FC0EE3E293D3596265AD2F637E55B7B328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_838ea66faef69d8633a3210dbb152589_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_plugx_poet-rat_pos_quasar-rat_rusty-stealer_satacom_stealc_vidar

File Explorer

2026-08-13_838ea66faef69d8633a3210dbb152589_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_plugx_poet-rat_pos_quasar-rat_rusty-stealer_satacom_stealc_vidar

.exe 115.1MB

2026-08-13_838ea66faef69d8633a3210dbb152589_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_plugx_poet-rat_pos_quasar-rat_rusty-stealer_satacom_stealc_vidar

IMPHASH dc4fea925a19ae42accea3a8fbe3474f
SHA256 8a8c65069163c42874ff227c13b57dc3c9217e7d6fc349a95e4aaef411b14fa9
MD5 838ea66faef69d8633a3210dbb152589
SHA1 ba1443777793e22c22deb8bac855032346bdbff0
SHA512 dd0c0e0ec611ddf660c7a453910b567a597ea4a8ae00fdc833350f52bf1cbbdf7937332fb20f62773e79662bd9e9ff110c2616f728bb674c66e9f23a2b28202e
SSDEEP 786432:4i8lv6zqmnQnPUj13y2dtmstgUzBAc34VmlShA1or4Ix:4i8lAqmnQPB24mlShA1246
TLSH
T103486B0113780094D492C639AE36B687CE71FC0EE3E293D3596265AD2F637E55B7B328
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

WriteConsoleW HeapReAlloc CreateDirectoryW SizeofResource SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError LockResource CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA SetDllDirectoryW LoadLibraryExW GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetFilePointerEx RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA MultiByteToWideChar HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx HeapSize

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_838ea66faef69d8633a3210dbb152589_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_plugx_poet-rat_pos_quasar-rat_rusty-stealer_satacom_stealc_vidar

shell32

kernel32

generic