2026-09-10_4b1783ce05d6c18b00c4530aa099bd37_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_4b1783ce05d6c18b00c4530aa099bd37_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom_vidar
Size 48.6MB
Sample260910-vrk4bsem6y
SHA256 1ce994854f5ba61a050cd9c8fbf99dc93af41da634525ee7282f4203b807b814
MD5 4b1783ce05d6c18b00c4530aa099bd37
SHA1 29d5fcb7b24bce46b7200272ae08bf3b8ab141da
SHA512 a1c0e3bf3638a732ad4bd6fa7068f4663b3d0ccfd81f9bfd60d21fe1d7eab31f978e2ed31dcd3c90e523129217b7b7add29e75b4950c9baf85871334c70c82ec
SSDEEP 98304:YPqwyw29XDgl5TkZVGF6Pymqrgz+UuvP01V85Vtc/OcY2n+Jw:YaXkfTqrgV6WgYw
TLSH
T1F7B7A432CE450E674EF262BC69658AE3FA70A32F1380591BBDFC9A4C1F36D716142B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-10_4b1783ce05d6c18b00c4530aa099bd37_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom_vidar

File Explorer

2026-09-10_4b1783ce05d6c18b00c4530aa099bd37_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom_vidar

.exe 48.6MB

2026-09-10_4b1783ce05d6c18b00c4530aa099bd37_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom_vidar

IMPHASH e91164e31f2fa1bb54472b4908ee197d
SHA256 1ce994854f5ba61a050cd9c8fbf99dc93af41da634525ee7282f4203b807b814
MD5 4b1783ce05d6c18b00c4530aa099bd37
SHA1 29d5fcb7b24bce46b7200272ae08bf3b8ab141da
SHA512 a1c0e3bf3638a732ad4bd6fa7068f4663b3d0ccfd81f9bfd60d21fe1d7eab31f978e2ed31dcd3c90e523129217b7b7add29e75b4950c9baf85871334c70c82ec
SSDEEP 98304:YPqwyw29XDgl5TkZVGF6Pymqrgz+UuvP01V85Vtc/OcY2n+Jw:YaXkfTqrgV6WgYw
TLSH
T1F7B7A432CE450E674EF262BC69658AE3FA70A32F1380591BBDFC9A4C1F36D716142B45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ce:54:5a:91:ae:24:01:c6:d1:91:77:da:b4:75:08:d4:a5:75:63:56:24:08:d8:f3:a1:d3:d6:4a:60:5f:ec:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Application Publisher,O=Software Company,C=US

Chains

Sep 7, 2026

CN=Application Publisher,O=Software Company,C=US

Subject

CN=Application Publisher,O=Software Company,C=US

Serial Number

5c:c0:a0:3d:aa:fa:04:47:a6:1d:56:04:64:04:c5:10:6f:21:a1:c0

Issuer

CN=Application Publisher,O=Software Company,C=US

Revocation Status

Not revoked

Timespan

Feb 5, 2026 - Feb 5, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

3174192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

product_name_tauri_flag.pdb

kernel32

GetModuleHandleA RtlPcToFileHeader SetFileInformationByHandle LoadLibraryW Sleep WaitForSingleObjectEx WaitForSingleObject FindClose GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW GetTempPathW SetHandleInformation GetFinalPathNameByHandleW SleepEx SetWaitableTimer ExitProcess GetFileAttributesW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess FindNextFileW RtlUnwindEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent GetCurrentThreadId TerminateProcess TlsAlloc GetCurrentProcessId TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW ReleaseMutex SetEnvironmentVariableW GetLastError GetProcAddress LoadLibraryA GetCurrentThread SwitchToThread WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetModuleHandleW GetSystemTimeAsFileTime SetLastError GetFullPathNameW FreeLibrary LoadLibraryExW OutputDebugStringW OutputDebugStringA LoadLibraryExA GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal CancelIo CreateWaitableTimerExW GetSystemInfo InitializeSListHead SetFileCompletionNotificationModes SetThreadStackGuarantee DeleteFileW QueryPerformanceCounter GetSystemTimePreciseAsFileTime ReadFileEx CreateEventW WriteFileEx CreateThread GetProcessHeap HeapFree HeapAlloc DeleteCriticalSection GetDiskFreeSpaceExW QueryPerformanceFrequency CloseHandle GetCurrentProcess GlobalMemoryStatusEx GetTickCount64 FormatMessageW AddVectoredExceptionHandler HeapReAlloc CreateDirectoryW lstrlenW IsDebuggerPresent MultiByteToWideChar GetUserDefaultUILanguage LCIDToLocaleName UnhandledExceptionFilter WideCharToMultiByte InitializeCriticalSectionAndSpinCount CreateMutexA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleFileNameW CreateFileW SetUnhandledExceptionFilter CreateProcessW CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx ReadFile PostQueuedCompletionStatus WriteFile CreateMutexW GetOverlappedResult SetDefaultDllDirectories DeviceIoControl

user32

EnumDisplaySettingsW GetWindow DestroyWindow AdjustWindowRect RedrawWindow GetWindowLongPtrW GetRawInputData PostMessageW MapVirtualKeyW SetCapture ReleaseCapture RegisterRawInputDevices RegisterClassExW CreateWindowExW GetKeyboardLayout MapVirtualKeyExW GetKeyState ToUnicodeEx GetSystemMetrics EnableWindow IsWindowEnabled RegisterTouchWindow SetWindowPos GetAsyncKeyState TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle GetMessageA TranslateMessage DispatchMessageA EnumChildWindows VkKeyScanW SendInput GetActiveWindow SetFocus SetTimer KillTimer GetParent SetWindowRgn GetKeyboardState FindWindowExW GetMonitorInfoW GetMessageW ScreenToClient SystemParametersInfoW DispatchMessageW RegisterClassW ChangeWindowMessageFilterEx FlashWindowEx LoadCursorW SetCursor SendMessageW IsIconic GetMenuItemInfoW SetWindowLongPtrW ValidateRect SetCursorPos UpdateWindow InvalidateRect GetForegroundWindow SetWindowTextW IsWindowVisible GetWindowTextW GetWindowTextLengthW SetParent SetPropW MonitorFromPoint SetWindowDisplayAffinity PostThreadMessageW MonitorFromRect ShowCursor ClipCursor GetClipCursor GetWindowPlacement IsWindow SetWindowPlacement ChangeDisplaySettingsExW SetWindowLongW GetSystemMenu AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn RegisterWindowMessageA IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC AppendMenuW InsertMenuW CheckMenuItem DrawTextW FillRect OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu PeekMessageW DefWindowProcW FindWindowW ReleaseDC GetWindowDC GetDesktopWindow EnumDisplayMonitors TranslateAcceleratorW MsgWaitForMultipleObjectsEx GetUpdateRect

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

advapi32

RegCreateKeyTransactedW RegCreateKeyExW OpenProcessToken GetTokenInformation RegCloseKey SystemFunction036 RegOpenKeyTransactedW RegOpenKeyExW RegDeleteTreeW RegSetValueExW RegQueryValueExW RegGetValueW EventUnregister EventWriteTransfer EventSetInformation EventRegister

gdi32

CombineRgn SetBkMode SetTextColor DeleteDC DeleteObject CreateSolidBrush CreateRectRgn GetDIBits BitBlt CreateDIBSection SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDeviceCaps

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile RtlNtStatusToDosError NtCreateNamedPipeFile NtWriteFile RtlGetVersion NtOpenFile NtReadFile

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

ole32

CoTaskMemAlloc RegisterDragDrop CoInitializeEx CoCreateFreeThreadedMarshaler CoTaskMemFree RevokeDragDrop CoInitialize OleInitialize CoUninitialize CoCreateInstance

shell32

Shell_NotifyIconW DragFinish SHGetKnownFolderPath ShellExecuteW DragQueryFileW Shell_NotifyIconGetRect ShellExecuteExW SHOpenFolderAndSelectItems ILFree ILCreateFromPathW SHAppBarMessage

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

shlwapi

SHCreateMemStream

ws2_32

getsockname WSAGetLastError accept listen bind ioctlsocket WSAIoctl socket getpeername recv WSASend shutdown send WSASocketW connect getsockopt setsockopt freeaddrinfo getaddrinfo closesocket WSAStartup WSACleanup

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

wcscmp _wcsicmp strlen wcsncmp strcpy_s wcslen

api-ms-win-crt-math-l1-1-0

pow roundf trunc __setusermatherr round floor

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _register_onexit_function _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _crt_atexit exit _exit abort __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc _callnewh free malloc

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45.2MB

Virtual Size

45.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cache

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_4b1783ce05d6c18b00c4530aa099bd37_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom_vidar

PE Signature issue

kernel32

user32

api-ms-win-core-synch-l1-2-0

dwmapi

advapi32

gdi32

ntdll

oleaut32

ole32

shell32

comctl32

shlwapi

ws2_32

bcryptprimitives

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic