2026-10-19_41bc3330ae7bcd47cbb0cf4a508e967e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_41bc3330ae7bcd47cbb0cf4a508e967e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom
Size 3.1MB
Sample261020-2anapaxy9q
SHA256 b5700215c113a5fc98b0b4fba2775a2f1f464428ad7153878b9e00db2c23514a
MD5 41bc3330ae7bcd47cbb0cf4a508e967e
SHA1 b4beb54916a75c50c1dea4c68525ee0a805df184
SHA512 93fccc1deed581b0c000482f76a512a5d3714759990b0e56f33983be2d5bf6dbcd758e575c69ca73a719fcceb54faec2fae6c5f9f9a5be7834cc0ea5727b49f0
SSDEEP 49152:AZX1wUb65wEZIJKbuQogtTDeaLjqcZz+WvALVPjm2jj0uT+9ic:AMUbUDIEbZahPaxsc
TLSH
T10CE5BE43E69980E9C59BC07CC71B9627EA33B88D4B30B6DF67D44A113E26B905F2E354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_41bc3330ae7bcd47cbb0cf4a508e967e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

File Explorer

2026-10-19_41bc3330ae7bcd47cbb0cf4a508e967e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

.exe 3.1MB

2026-10-19_41bc3330ae7bcd47cbb0cf4a508e967e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

IMPHASH 1899314a77fbc7c693df1edbb9eb9a16
SHA256 b5700215c113a5fc98b0b4fba2775a2f1f464428ad7153878b9e00db2c23514a
MD5 41bc3330ae7bcd47cbb0cf4a508e967e
SHA1 b4beb54916a75c50c1dea4c68525ee0a805df184
SHA512 93fccc1deed581b0c000482f76a512a5d3714759990b0e56f33983be2d5bf6dbcd758e575c69ca73a719fcceb54faec2fae6c5f9f9a5be7834cc0ea5727b49f0
SSDEEP 49152:AZX1wUb65wEZIJKbuQogtTDeaLjqcZz+WvALVPjm2jj0uT+9ic:AMUbUDIEbZahPaxsc
TLSH
T10CE5BE43E69980E9C59BC07CC71B9627EA33B88D4B30B6DF67D44A113E26B905F2E354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1056512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

collector.pdb

kernel32

GetConsoleOutputCP GetStdHandle WriteConsoleW GetOverlappedResult GetFileInformationByHandle ReadFile WriteFileEx CreateIoCompletionPort ReleaseMutex SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW SetFileTime FindFirstFileExW GetSystemTimePreciseAsFileTime CreateDirectoryW CreateEventW CancelIo CreateMutexA CreateFileW GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle WaitForMultipleObjects GetTempPathW DeleteFileW CopyFileExW GetCurrentProcessId CreateWaitableTimerExW SetWaitableTimer Sleep SetFileCompletionNotificationModes LoadLibraryA SetFilePointerEx FindNextFileW WaitForSingleObjectEx GetCurrentThreadId PostQueuedCompletionStatus GetProcAddress GetConsoleMode CancelIoEx GetModuleHandleW HeapReAlloc GetCurrentThread SetThreadStackGuarantee GetQueuedCompletionStatusEx WaitForSingleObject IsProcessorFeaturePresent SetLastError WriteFile TerminateProcess MoveFileExW GetProcessId SwitchToThread SetFileInformationByHandle GetFileInformationByHandleEx FindClose GetExitCodeProcess FormatMessageW GetLastError SleepEx GetFinalPathNameByHandleW ReadFileEx HeapAlloc GetSystemTimeAsFileTime HeapFree GetProcessHeap GetCurrentProcess CloseHandle SetUnhandledExceptionFilter FreeEnvironmentStringsW AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW UnhandledExceptionFilter WideCharToMultiByte RtlVirtualUnwind MultiByteToWideChar GetEnvironmentVariableW CompareStringOrdinal IsDebuggerPresent QueryPerformanceCounter InitializeSListHead QueryPerformanceFrequency GetEnvironmentStringsW

advapi32

RegQueryValueExW RegCloseKey SystemFunction036 RegOpenKeyExW

ntdll

NtOpenFile RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtWriteFile

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

shutdown WSASend recv WSASocketW setsockopt ioctlsocket connect getsockopt WSAIoctl WSACleanup getaddrinfo freeaddrinfo getsockname WSAGetLastError getpeername send bind WSAStartup closesocket

crypt32

CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertFreeCertificateContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertOpenStore CertDuplicateStore CertCloseStore CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain

secur32

AcceptSecurityContext AcquireCredentialsHandleA QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle

bcryptprimitives

ProcessPrng

vcruntime140

memset __CxxFrameHandler3 memcpy memcmp __C_specific_handler __current_exception __current_exception_context memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr log2

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm terminate _seh_filter_exe _crt_atexit _initterm_e exit _exit _register_onexit_function _initialize_onexit_table __p___argc __p___argv _register_thread_local_exe_atexit_callback _c_exit _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_41bc3330ae7bcd47cbb0cf4a508e967e_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

kernel32

advapi32

ntdll

bcrypt

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

secur32

bcryptprimitives

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic