2026-08-18_bcb07115851adf6bc1f7264eb48ce7f2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_bcb07115851adf6bc1f7264eb48ce7f2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar
Size 27.7MB
Sample260818-cbmm4stfld
SHA256 e34e3ec143a55f222141e0b44a8adec4ff9ea7b6cb863ea19370d43fae41dc19
MD5 bcb07115851adf6bc1f7264eb48ce7f2
SHA1 772756f15c63807a6bed6805172876e53ce3ceb2
SHA512 dff15282f2c454258fde64c227470c3c430530b824dd386724e5b5aebc30867a5bddf57edb8b61fa39865f1ae25f81503d4f9678cd3d0dfd85685a6b583322b2
SSDEEP 196608:DFORegDe2rd9tjcGIRkxwXx87Z0wQppeq:cR+2rd9tjGkxS810w6pz
TLSH
T1DC57F7153B9A6C6DD15AC8B0834B4A630E2134EB1A36B9FF84D845353FADAB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_bcb07115851adf6bc1f7264eb48ce7f2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

File Explorer

2026-08-18_bcb07115851adf6bc1f7264eb48ce7f2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

.exe 27.7MB

2026-08-18_bcb07115851adf6bc1f7264eb48ce7f2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

IMPHASH 204881d10c19483d016646965f7680ca
SHA256 e34e3ec143a55f222141e0b44a8adec4ff9ea7b6cb863ea19370d43fae41dc19
MD5 bcb07115851adf6bc1f7264eb48ce7f2
SHA1 772756f15c63807a6bed6805172876e53ce3ceb2
SHA512 dff15282f2c454258fde64c227470c3c430530b824dd386724e5b5aebc30867a5bddf57edb8b61fa39865f1ae25f81503d4f9678cd3d0dfd85685a6b583322b2
SSDEEP 196608:DFORegDe2rd9tjcGIRkxwXx87Z0wQppeq:cR+2rd9tjGkxS810w6pz
TLSH
T1DC57F7153B9A6C6DD15AC8B0834B4A630E2134EB1A36B9FF84D845353FADAB41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29235712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

GetModuleFileNameW GetFileInformationByHandle SetUnhandledExceptionFilter GetFullPathNameW FindNextFileW CreateDirectoryW FindFirstFileW ReadConsoleW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW DeleteProcThreadAttributeList GetFileAttributesW DuplicateHandle InitializeProcThreadAttributeList UpdateProcThreadAttribute CreateThread SleepEx WriteFileEx ReadFileEx CreateNamedPipeW GetExitCodeProcess CreateEventW CancelIo ExitProcess UnhandledExceptionFilter DeviceIoControl GetSystemTimePreciseAsFileTime CreateIoCompletionPort DeleteFileW GetConsoleScreenBufferInfo GetModuleHandleW SetConsoleMode GetEnvironmentVariableA GetTempPathW FlsAlloc FlsSetValue FlsFree GetProcessTimes RtlLookupFunctionEntry GetCurrentProcessorNumber VirtualAlloc VirtualFree VirtualQuery GetLargePageMinimum FreeLibrary SetNamedPipeHandleState GetNumaHighestNodeNumber CreateFileW GetNumaNodeProcessorMask WriteConsoleA QueryPerformanceFrequency WriteConsoleW GetEnvironmentVariableW GetCommandLineW GetStdHandle GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WideCharToMultiByte ReleaseMutex CloseHandle CreateMutexA GetCurrentProcessId GetCurrentProcess GetProcAddress LoadLibraryA WaitForSingleObjectEx MultiByteToWideChar TerminateProcess GetModuleHandleA lstrlenW CancelIoEx RtlVirtualUnwind RtlCaptureContext GetCurrentDirectoryW WriteFile GetOverlappedResult ReadFile ConnectNamedPipe IsProcessorFeaturePresent GetQueuedCompletionStatusEx GetCurrentThreadId GetSystemTimeAsFileTime GetFileType GetConsoleMode GetLastError InitializeSListHead IsDebuggerPresent WaitForSingleObject SetWaitableTimer Sleep CreateWaitableTimerExW GetFinalPathNameByHandleW FormatMessageW SetLastError SetFileInformationByHandle SetFilePointerEx GetSystemInfo PostQueuedCompletionStatus QueryPerformanceCounter GetFileInformationByHandleEx SwitchToThread SetConsoleTextAttribute FindClose WaitForMultipleObjects

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtReadFile NtWriteFile NtDeviceIoControlFile

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueA

vcruntime140

strstr _CxxThrowException __C_specific_handler __CxxFrameHandler3 memcpy memset memmove memcmp __current_exception_context __current_exception

api-ms-win-crt-math-l1-1-0

pow __setusermatherr round

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _register_onexit_function exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _errno _crt_atexit terminate _exit

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

__p__commode fputs __acrt_iob_func _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-18_bcb07115851adf6bc1f7264eb48ce7f2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

shell32

ole32

ntdll

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic