2026-10-26_fec52447bd7bf8c1af5f481285285908_akira_cobalt-strike_glassworm_icedid_luca-stealer_poet-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_fec52447bd7bf8c1af5f481285285908_akira_cobalt-strike_glassworm_icedid_luca-stealer_poet-rat_rusty-stealer_satacom
Size 21.2MB
Sample261027-a9mpnahw61
SHA256 83887367caaadab3c4d2138262c359a6e7f3b4b838560333f5813c4c8bee807d
MD5 fec52447bd7bf8c1af5f481285285908
SHA1 23eed280ebeeb1da80c636ea4d6e66992d104188
SHA512 2132c8bc18336e99d76661bb31d6453f5631d6431ef7683db0f5a1b53080eac1ad7c4d2248c650d608f2f53cb3449c56e1d9d56a52184343f1b4e483d6b6cbdb
SSDEEP 196608:hmwCZz/J4ZDvc6pMqlHpv+ucLdr9kma5J+cEvwdAm0lk:hmzz/s06pDlBcV9kn0cEvwdAll
TLSH
T18A279E0777DBAC6ED207C4B4830A47735A11B49B2B22B9EB51C465393FAEBE04B2D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_fec52447bd7bf8c1af5f481285285908_akira_cobalt-strike_glassworm_icedid_luca-stealer_poet-rat_rusty-stealer_satacom

File Explorer

2026-10-26_fec52447bd7bf8c1af5f481285285908_akira_cobalt-strike_glassworm_icedid_luca-stealer_poet-rat_rusty-stealer_satacom

.exe 21.2MB

2026-10-26_fec52447bd7bf8c1af5f481285285908_akira_cobalt-strike_glassworm_icedid_luca-stealer_poet-rat_rusty-stealer_satacom

IMPHASH 631af4a1c8d59f60d588227b0e79d0fe
SHA256 83887367caaadab3c4d2138262c359a6e7f3b4b838560333f5813c4c8bee807d
MD5 fec52447bd7bf8c1af5f481285285908
SHA1 23eed280ebeeb1da80c636ea4d6e66992d104188
SHA512 2132c8bc18336e99d76661bb31d6453f5631d6431ef7683db0f5a1b53080eac1ad7c4d2248c650d608f2f53cb3449c56e1d9d56a52184343f1b4e483d6b6cbdb
SSDEEP 196608:hmwCZz/J4ZDvc6pMqlHpv+ucLdr9kma5J+cEvwdAm0lk:hmzz/s06pDlBcV9kn0cEvwdAll
TLSH
T18A279E0777DBAC6ED207C4B4830A47735A11B49B2B22B9EB51C465393FAEBE04B2D705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9490720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx GetModuleHandleW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx PostQueuedCompletionStatus FlushFileBuffers CreateDirectoryW CancelIo GetModuleHandleA GetFinalPathNameByHandleW SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx LoadLibraryW GlobalFree GlobalAlloc GlobalUnlock ReadFile GlobalLock OpenEventW GetOverlappedResult SetLastError GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW SetHandleInformation DuplicateHandle VirtualQueryEx GetFileType ExitProcess SetEvent CreateThread CreateEventW WaitForMultipleObjects GetThreadPriority GetSystemTimeAsFileTime SetFilePointerEx GetConsoleOutputCP QueryFullProcessImageNameW LocalFree GetThreadTimes OpenProcess GetPriorityClass GetTempPathW DeleteFileW GlobalMemoryStatusEx GetProcessTimes QueryProcessCycleTime GetExitCodeProcess WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW GetCurrentProcessId GetSystemTimePreciseAsFileTime Sleep GetSystemInfo MoveFileExW CloseHandle WaitForMultipleObjectsEx SwitchToThread SetThreadPriority GetCurrentThreadId CreateEventA SetStdHandle IsProcessorFeaturePresent FindNextFileW TerminateProcess HeapReAlloc SetThreadStackGuarantee SetProcessInformation GetCurrentProcess GetCurrentThread HeapFree GetProcessHeap LoadLibraryExW SetThreadErrorMode FreeLibrary GetProcAddress GetModuleFileNameW WriteFile FlsFree FlsSetValue HeapSize WriteConsoleW HeapAlloc ReadFileEx SleepEx WriteFileEx GetLastError LoadLibraryExA FlsGetValue FlsAlloc VirtualProtect GetStartupInfoW GetModuleHandleExW FindClose GetFullPathNameW GlobalSize InitializeCriticalSectionEx LCMapStringW GetEnvironmentStringsW CompareStringOrdinal FormatMessageW GetEnvironmentVariableW GetCurrentDirectoryW lstrlenW WideCharToMultiByte MultiByteToWideChar Module32NextW Module32FirstW QueryPerformanceCounter QueryPerformanceFrequency Process32NextW Process32FirstW K32GetProcessMemoryInfo GetSystemPowerStatus GetUserDefaultLangID GetUserDefaultUILanguage CompareStringW AddVectoredExceptionHandler GetStringTypeW SetEnvironmentVariableW InitializeSListHead SetUnhandledExceptionFilter RaiseException GetCPInfo EncodePointer EnterCriticalSection LeaveCriticalSection FreeEnvironmentStringsW DeleteCriticalSection GetCommandLineA GetCommandLineW IsDebuggerPresent GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

ImpersonateAnonymousToken GetTokenInformation RevertToSelf OpenProcessToken RegQueryValueExW RegCloseKey RegOpenKeyExW

crypt32

CertDuplicateCertificateContext CertEnumCertificatesInStore CertAddCertificateContextToStore CertOpenStore CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CryptProtectData CryptUnprotectData CertCloseStore

ws2_32

WSAStartup connect getaddrinfo freeaddrinfo WSASend WSAIoctl WSACleanup getsockopt getsockname getpeername send recv setsockopt accept ioctlsocket closesocket WSAGetLastError listen bind WSASocketW shutdown

bcrypt

BCryptGenRandom

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile RtlPcToFileHeader RtlUnwindEx NtWriteFile NtReadFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtSetTimerResolution NtOpenFile NtCreateNamedPipeFile

secur32

FreeCredentialsHandle DecryptMessage EncryptMessage AcquireCredentialsHandleA DeleteSecurityContext AcceptSecurityContext ApplyControlToken FreeContextBuffer QueryContextAttributesW InitializeSecurityContextW

oleaut32

SysStringLen SysAllocStringLen SafeArrayPutElement GetErrorInfo SafeArrayCreateVector SetErrorInfo SysFreeString

user32

ShowCursor LoadCursorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent ReleaseCapture SetCapture GetSystemMenu EnableMenuItem AdjustWindowRectEx GetKeyboardLayout MonitorFromRect GetMenu RedrawWindow SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW InvalidateRgn IsProcessDPIAware GetKeyState GetKeyboardState RegisterTouchWindow MonitorFromWindow RegisterClassExW GetWindowLongPtrW CreateIconFromResourceEx SendMessageW GetSystemMetrics GetActiveWindow GetClassNameW MessageBoxW MonitorFromPoint FillRect SetLayeredWindowAttributes ReleaseDC GetDC UpdateLayeredWindow GetClassInfoExW GetTopWindow GetClientRect ScreenToClient ClipCursor GetClipCursor CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW PeekMessageW SendInput MapVirtualKeyW GetMonitorInfoW EnumDisplayDevicesW EnumDisplaySettingsW EnumDisplayMonitors SetThreadDpiAwarenessContext SetCursorPos GetWindowRect DestroyMenu PostMessageW GetCursorPos SetMenuDefaultItem AppendMenuW CreatePopupMenu SetWindowPos GetWindow SetWindowDisplayAffinity GetWindowDisplayAffinity GetAncestor SetForegroundWindow IsWindowVisible SetWindowLongW GetWindowLongW GetWindowThreadProcessId RegisterHotKey MapVirtualKeyExW ToUnicodeEx SystemParametersInfoA SetClipboardData SetCursor EmptyClipboard GetClipboardData RegisterRawInputDevices GetRawInputData ValidateRect IsClipboardFormatAvailable PostThreadMessageW RegisterWindowMessageA CreateIcon DestroyIcon GetWindowTextLengthW GetWindowTextW FlashWindowEx DestroyWindow SetWindowTextW TrackPopupMenu SetProcessDpiAwarenessContext DefWindowProcW ClientToScreen SetPropW SetWindowLongPtrW GetPropW CallWindowProcW RemovePropW OpenClipboard CloseClipboard GetForegroundWindow GetAsyncKeyState RegisterClassW CreateWindowExW RegisterWindowMessageW ChangeWindowMessageFilterEx GetMessageW TranslateMessage DispatchMessageW ShowWindow EnumWindows IsWindow IsIconic SetTimer SetWinEventHook UnhookWinEvent KillTimer UnregisterHotKey

opengl32

wglDeleteContext wglGetCurrentContext wglGetProcAddress wglGetCurrentDC wglCreateContext wglShareLists wglMakeCurrent

shlwapi

AssocQueryStringW

shell32

ShellExecuteW DragQueryFileW DragFinish ExtractIconW Shell_NotifyIconW

gdi32

Ellipse CreateDIBSection SelectObject DescribePixelFormat ChoosePixelFormat CreateRectRgn SetPixelFormat SwapBuffers Polygon GetTextExtentPoint32W TextOutW SetTextAlign CreateFontW SetDCBrushColor CreateCompatibleDC CreatePatternBrush CreateBitmap SetBkMode GetStockObject CreateCompatibleBitmap BitBlt SetBkColor SetTextColor PolyPolyline SetDCPenColor PatBlt GetDeviceCaps DeleteDC DeleteObject

winmm

timeBeginPeriod

uiautomationcore

UiaRaiseAutomationEvent UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaReturnRawElementProvider

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop

dxgi

CreateDXGIFactory1 CreateDXGIFactory2

winhttp

WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect WinHttpOpen WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow

d3d11

D3D11CreateDevice

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice

comdlg32

GetOpenFileNameW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

imm32

ImmAssociateContextEx ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW ImmReleaseContext ImmGetContext

uxtheme

SetWindowTheme

Name

.text

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10.5MB

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

747KB

Virtual Size

776KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_fec52447bd7bf8c1af5f481285285908_akira_cobalt-strike_glassworm_icedid_luca-stealer_poet-rat_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

crypt32

ws2_32

bcrypt

ntdll

secur32

oleaut32

user32

opengl32

shlwapi

shell32

gdi32

winmm

uiautomationcore

ole32

dxgi

winhttp

dwmapi

d3d11

d2d1

dwrite

dcomp

comdlg32

api-ms-win-shcore-scaling-l1-1-1

imm32

uxtheme

generic