2026-09-17_97dba85f4b213b38d1d1f154b4225ad2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-17_97dba85f4b213b38d1d1f154b4225ad2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar
Size 10.7MB
Sample260918-cffelagf36
SHA256 fe44af16e12c6cb66d1c72bbfd29beb54868b31c6f35d73519059ef44b2c4980
MD5 97dba85f4b213b38d1d1f154b4225ad2
SHA1 b076c41c308b67119c0d77e1e06a936242c23506
SHA512 37a10854a242d36608cbb7f8a31afbab5480651a4019086b7a20ffd959d51b81e3d34345b1acfd3b966704c0fa127eb46f8ed78776bb9aff3102ee6a38991c85
SSDEEP 98304:t31OjE6O5ubbvsfpAmGs0ITIECwa99bUHpA3ZUnPJcJ:GjE6RvuAGY9bUSJUPJcJ
TLSH
T1C3B64B15BFCA99ADC05EC070824A47725A3570CB0B35BAFF899645393F6AAF41F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-17_97dba85f4b213b38d1d1f154b4225ad2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

File Explorer

2026-09-17_97dba85f4b213b38d1d1f154b4225ad2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

.exe 10.7MB

2026-09-17_97dba85f4b213b38d1d1f154b4225ad2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

IMPHASH 90b40e989f5c073c169a739b7d9243e2
SHA256 fe44af16e12c6cb66d1c72bbfd29beb54868b31c6f35d73519059ef44b2c4980
MD5 97dba85f4b213b38d1d1f154b4225ad2
SHA1 b076c41c308b67119c0d77e1e06a936242c23506
SHA512 37a10854a242d36608cbb7f8a31afbab5480651a4019086b7a20ffd959d51b81e3d34345b1acfd3b966704c0fa127eb46f8ed78776bb9aff3102ee6a38991c85
SSDEEP 98304:t31OjE6O5ubbvsfpAmGs0ITIECwa99bUHpA3ZUnPJcJ:GjE6RvuAGY9bUSJUPJcJ
TLSH
T1C3B64B15BFCA99ADC05EC070824A47725A3570CB0B35BAFF899645393F6AAF41F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11078144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter GetProcAddress GetProcessTimes TlsAlloc GetProcessIoCounters GetLastError VirtualQueryEx ReadProcessMemory LoadLibraryExW LocalFree HeapFree AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader GetCurrentThreadId HeapAlloc GetTickCount64 GlobalMemoryStatusEx OpenProcess GetLogicalDrives GetDiskFreeSpaceExW GetSystemInfo GetCurrentProcessId CreateFileW GetProcessHeap InitializeCriticalSectionAndSpinCount ReleaseSRWLockExclusive GetDriveTypeW GetVolumeInformationW DeviceIoControl DeleteCriticalSection TlsGetValue GetModuleHandleW CreateMutexA WaitForSingleObjectEx GetTempPathW RtlUnwindEx FreeLibrary GetModuleFileNameW EncodePointer CreateThread lstrlenW WideCharToMultiByte IsProcessorFeaturePresent WriteConsoleW MultiByteToWideChar UpdateProcThreadAttribute LoadLibraryA InitializeProcThreadAttributeList CreateProcessW WaitForSingleObject GetWindowsDirectoryW FormatMessageW GetSystemDirectoryW GetFullPathNameW GetUserDefaultUILanguage LCIDToLocaleName ReadFileEx LoadLibraryW CreateNamedPipeW ExitProcess SetEnvironmentVariableW SetCurrentDirectoryW GetFinalPathNameByHandleW MoveFileExW DeleteFileW FindFirstFileW CreateDirectoryW GetFileInformationByHandleEx FindClose FindNextFileW ReleaseMutex HeapReAlloc GetSystemTimePreciseAsFileTime QueryPerformanceFrequency TerminateProcess SleepEx WriteFileEx GetStdHandle SetFileInformationByHandle GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter RaiseException SetThreadErrorMode SetWaitableTimer CreateWaitableTimerExW SwitchToThread TlsFree GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CompareStringOrdinal DeleteProcThreadAttributeList FreeEnvironmentStringsW GetConsoleMode GetFileInformationByHandle GetModuleHandleA Sleep TlsSetValue GetSystemTimeAsFileTime GetFileAttributesW OutputDebugStringA OutputDebugStringW CloseHandle InitializeSListHead IsDebuggerPresent GetSystemTimes GetEnvironmentVariableW GetCurrentProcess DuplicateHandle PostQueuedCompletionStatus SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort SetHandleInformation

user32

GetClipCursor SetWindowLongW SendMessageW EnableMenuItem GetSystemMenu ShowWindow GetRawInputData DestroyAcceleratorTable DestroyIcon SetCapture ShowCursor GetMenu SetWindowDisplayAffinity FlashWindowEx MsgWaitForMultipleObjectsEx RegisterRawInputDevices IsProcessDPIAware GetDC GetWindowLongPtrW CheckMenuItem EnumChildWindows DefWindowProcW SetMenuItemInfoW CreateMenu AppendMenuW SendInput PostThreadMessageW PostQuitMessage CreateIcon ScreenToClient EnumDisplayMonitors MonitorFromPoint GetWindowRect GetWindowLongW PeekMessageW AdjustWindowRectEx IsWindowVisible SystemParametersInfoA ClipCursor DispatchMessageW SetWindowTextW MonitorFromRect GetWindowTextLengthW GetWindowTextW RegisterClassExW SetForegroundWindow CreateAcceleratorTableW GetKeyboardState GetAsyncKeyState GetKeyState MapVirtualKeyExW TrackMouseEvent VkKeyScanW GetKeyboardLayout GetTouchInputInfo ToUnicodeEx RegisterWindowMessageA GetMessageA DispatchMessageA TranslateMessage TranslateAcceleratorW GetAncestor GetMessageW DestroyWindow GetForegroundWindow RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW SetCursorPos InvalidateRgn SetWindowPos ClientToScreen PostMessageW ReleaseCapture GetCursorPos IsIconic GetActiveWindow SetMenu GetClientRect CloseTouchInputHandle RedrawWindow GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW MapVirtualKeyW GetUpdateRect ValidateRect SetCursor LoadCursorW GetMonitorInfoW MonitorFromWindow SetWindowLongPtrW

gdi32

CreateRectRgn GetDeviceCaps DeleteObject

dwmapi

DwmEnableBlurBehindWindow

ole32

CoSetProxyBlanket CoCreateInstance OleInitialize RegisterDragDrop CoInitializeSecurity CoInitializeEx CreateStreamOnHGlobal CoTaskMemAlloc CoUninitialize RevokeDragDrop CoTaskMemFree

comctl32

DefSubclassProc SetWindowSubclass RemoveWindowSubclass TaskDialogIndirect

shell32

DragFinish DragQueryFileW CommandLineToArgvW SHAppBarMessage ShellExecuteW SHGetKnownFolderPath SHCreateItemFromParsingName

secur32

ApplyControlToken EncryptMessage FreeCredentialsHandle LsaEnumerateLogonSessions LsaFreeReturnBuffer AcquireCredentialsHandleA LsaGetLogonSessionData QueryContextAttributesW AcceptSecurityContext FreeContextBuffer DeleteSecurityContext DecryptMessage InitializeSecurityContextW

advapi32

RegGetValueW EventUnregister RegQueryValueExW EventWriteTransfer EventSetInformation EventRegister SystemFunction036 RegCloseKey GetTokenInformation OpenProcessToken LookupAccountSidW CopySid GetLengthSid IsValidSid RegOpenKeyExW

ws2_32

WSAStartup getaddrinfo freeaddrinfo WSACleanup closesocket getsockname getpeername WSAGetLastError WSASocketW bind WSAIoctl setsockopt WSASend send recv shutdown getsockopt connect ioctlsocket

crypt32

CertCloseStore CertOpenStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertDuplicateStore CertDuplicateCertificateContext CertFreeCertificateContext CertFreeCertificateChain CertGetCertificateChain CertVerifyCertificateChainPolicy

oleaut32

GetErrorInfo SysFreeString SetErrorInfo VariantClear SysStringLen SysAllocString

ntdll

NtReadFile NtQueryInformationProcess NtWriteFile NtQuerySystemInformation RtlGetVersion NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError

psapi

GetPerformanceInfo GetModuleFileNameExW

pdh

PdhAddEnglishCounterW PdhRemoveCounter PdhCloseQuery PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

iphlpapi

GetIfTable2 FreeMibTable GetAdaptersAddresses GetIfEntry2

netapi32

NetUserGetLocalGroups NetUserGetInfo NetUserEnum NetApiBufferFree

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

wcsncmp strcpy_s _wcsicmp wcslen strlen

api-ms-win-crt-math-l1-1-0

pow floor __setusermatherr round trunc

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh calloc

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

__p___argv _set_app_type _configure_narrow_argv abort _initialize_narrow_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _cexit exit _exit _c_exit _seh_filter_exe _register_thread_local_exe_atexit_callback __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

299KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

558KB

Virtual Size

750KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-17_97dba85f4b213b38d1d1f154b4225ad2_akira_cobalt-strike_glassworm_quasar-rat_satacom_vidar

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

gdi32

dwmapi

ole32

comctl32

shell32

secur32

advapi32

ws2_32

crypt32

oleaut32

ntdll

psapi

pdh

powrprof

iphlpapi

netapi32

uxtheme

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic