2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
Size 7.9MB
Sample260910-2l4f2sxaph
SHA256 01661df0ad012f6425c36f0cd22d4e94602190a846f48c854fde5fbee4401188
MD5 dd3958e718403fe9fd55a2ecc0341d52
SHA1 585002c195cdf158f3d3939bea832f218387922f
SHA512 a9aee16258f723ab93288bdbf288a9254357c6d9c80437707cc017fb1e3b18499c1abbfeb932b11b89b535ca272da4433d2b355cdfd79c59cedeca6f79401c9f
SSDEEP 98304:X/5ICdsD0RjFe6nBdnf7gWKaKdeo6PDl3hJX0r+QY7GvfnN16t:X/5IqFewQaKdvPGt
TLSH
T13E863A217B5A99ADC15EC474828646B25A3170CB0B35BAFF45C446393FBABF11F3C298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

File Explorer

2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

.exe 7.9MB

2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

IMPHASH 41d92432bd086cf5b0c76819fc5cbc83
SHA256 01661df0ad012f6425c36f0cd22d4e94602190a846f48c854fde5fbee4401188
MD5 dd3958e718403fe9fd55a2ecc0341d52
SHA1 585002c195cdf158f3d3939bea832f218387922f
SHA512 a9aee16258f723ab93288bdbf288a9254357c6d9c80437707cc017fb1e3b18499c1abbfeb932b11b89b535ca272da4433d2b355cdfd79c59cedeca6f79401c9f
SSDEEP 98304:X/5ICdsD0RjFe6nBdnf7gWKaKdeo6PDl3hJX0r+QY7GvfnN16t:X/5IqFewQaKdvPGt
TLSH
T13E863A217B5A99ADC15EC474828646B25A3170CB0B35BAFF45C446393FBABF11F3C298
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

93:80:84:a3:bf:31:1c:de:d3:9a:32:6e:5d:3d:20:f9:66:f6:18:54:a1:1a:65:67:76:e0:c6:51:e7:aa:e2:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91440300MA5FAR1W6E,CN=Keroro Software LLC,O=Keroro Software LLC,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e7a68fe794b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Oct 11, 2025

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:55:56:bc:f2:5e:a4:35:35:c3:a4:0f:d5:ab:45:72

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0f:b8:a7:40:b9:15:8d:03:51:43:bc:59:d9:f0:40:29

Issuer

CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

May 15, 2026

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0c:d9:19:b7:90:e3:e7:9a:6b:bf:6f:77:93:a6:ed:99

Issuer

CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 31, 2025 - May 14, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4819236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tauri_elementplus_app.pdb

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtReadFile RtlNtStatusToDosError NtCreateFile NtWriteFile

kernel32

WideCharToMultiByte WriteConsoleW WaitForSingleObjectEx GetConsoleOutputCP CreateMutexA GetUserDefaultUILanguage MultiByteToWideChar GetFinalPathNameByHandleW CreateDirectoryW GetFileInformationByHandleEx CreateFileW LoadLibraryW SetEnvironmentVariableW GetTempPathW GetFullPathNameW CreateThread ExitProcess ReleaseMutex HeapReAlloc FindClose FindFirstFileExW GetModuleFileNameW OutputDebugStringA OutputDebugStringW lstrlenW GetProcAddress LCIDToLocaleName LoadLibraryExW GetModuleHandleW GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive GetEnvironmentVariableW WaitForSingleObject GetProcessHeap HeapFree FormatMessageW QueryPerformanceFrequency HeapAlloc Sleep GetModuleHandleA TerminateProcess WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException GetCurrentThreadId EncodePointer GetConsoleMode GetFileInformationByHandle SetFileCompletionNotificationModes DeleteCriticalSection SetHandleInformation InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree GetCurrentProcessId GetStdHandle FreeLibrary GetLastError GetFileAttributesW CloseHandle TlsSetValue LoadLibraryA GetCurrentProcess SetFileInformationByHandle GetCommandLineW GetCurrentDirectoryW SetLastError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo QueryPerformanceCounter SetWaitableTimer CreateWaitableTimerExW SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx

oleaut32

SysStringLen SetErrorInfo SysFreeString GetErrorInfo

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

SetWindowPos DispatchMessageA GetMessageA PostQuitMessage AppendMenuW CreateMenu SetMenuItemInfoW CreateAcceleratorTableW ToUnicodeEx GetKeyboardLayout VkKeyScanW GetClientRect MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState ClientToScreen PostMessageW SendInput SetForegroundWindow ReleaseCapture GetWindowTextW GetCursorPos InvalidateRgn SetWindowTextW CreateIcon SetWindowDisplayAffinity GetSystemMenu ShowWindow SetWindowLongW SendMessageW MonitorFromPoint ScreenToClient EnumDisplayMonitors DefWindowProcW FlashWindowEx GetRawInputData IsIconic GetWindowLongW IsProcessDPIAware MonitorFromRect PostThreadMessageW GetDC GetActiveWindow SetCursorPos SetMenu RedrawWindow DestroyWindow PeekMessageW TrackMouseEvent SystemParametersInfoA GetWindowLongPtrW IsWindowVisible ClipCursor GetClipCursor ShowCursor AdjustWindowRectEx GetMenu GetWindowRect CheckMenuItem EnableMenuItem DestroyAcceleratorTable DestroyIcon SetCapture SetWindowLongPtrW MsgWaitForMultipleObjectsEx RegisterRawInputDevices RegisterClassExW RegisterWindowMessageA DispatchMessageW TranslateMessage EnumChildWindows TranslateAcceleratorW GetAncestor GetMessageW GetWindowTextLengthW GetForegroundWindow RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW MapVirtualKeyW GetUpdateRect ValidateRect GetMonitorInfoW MonitorFromWindow SetCursor LoadCursorW CloseTouchInputHandle GetTouchInputInfo

comctl32

RemoveWindowSubclass SetWindowSubclass DefSubclassProc

ole32

CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx OleInitialize RevokeDragDrop RegisterDragDrop CoTaskMemAlloc CreateStreamOnHGlobal

shell32

DragFinish ShellExecuteW SHGetKnownFolderPath SHAppBarMessage DragQueryFileW

gdi32

GetDeviceCaps DeleteObject CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

bcrypt

BCryptGenRandom

advapi32

EventRegister EventSetInformation EventWriteTransfer EventUnregister SystemFunction036 RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyExW

uxtheme

SetWindowTheme

ws2_32

getaddrinfo closesocket WSAGetLastError WSASocketW bind connect ioctlsocket getsockname freeaddrinfo getpeername getsockopt shutdown recv send WSASend setsockopt WSAIoctl WSACleanup WSAStartup

secur32

DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleA ApplyControlToken EncryptMessage DeleteSecurityContext FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateStore CertCloseStore CertOpenStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain

api-ms-win-crt-math-l1-1-0

pow round __setusermatherr floor trunc

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strcpy_s wcsncmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _exit exit _initterm_e _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _configure_narrow_argv __p___argc _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm _initialize_narrow_environment abort _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc malloc _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_dd3958e718403fe9fd55a2ecc0341d52_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

PE Signature issue

ntdll

kernel32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

comctl32

ole32

shell32

gdi32

dwmapi

bcrypt

advapi32

uxtheme

ws2_32

secur32

crypt32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic