2026-11-02_e7fba385298c6a09de2ed36dee523d17_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_e7fba385298c6a09de2ed36dee523d17_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom
Size 10.2MB
Sample261102-ybcc2agb84
SHA256 27f9715e50f7e0c75597ac054dac4e367ec3dab34beee325786f712896e730dc
MD5 e7fba385298c6a09de2ed36dee523d17
SHA1 bf24eb9d50ae1f9da179150113ee3c0135fc3c55
SHA512 6a5113ce01d1b4e01c83efeb04fed9e1b50f589128b30b76a4c1777f13c60bf5903ee5dae90c4cd011828c39cd19098cc8219aa0a4368cca745b1432b06274c9
SSDEEP 98304:/H9DGHU7dlw9Ahji5c4LZa/AFptlYsQBOqUk+Wtzv8bTahPaxp81:fFGLR9QggtzUbOExq1
TLSH
T147B65B02BA6F54ECD59BC47483068A239E2174DB0B36BAEF418446393F6ABF05B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_e7fba385298c6a09de2ed36dee523d17_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

File Explorer

2026-11-02_e7fba385298c6a09de2ed36dee523d17_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

.exe 10.2MB

2026-11-02_e7fba385298c6a09de2ed36dee523d17_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

IMPHASH 2797ccba8cc94a31426670b81b0c4915
SHA256 27f9715e50f7e0c75597ac054dac4e367ec3dab34beee325786f712896e730dc
MD5 e7fba385298c6a09de2ed36dee523d17
SHA1 bf24eb9d50ae1f9da179150113ee3c0135fc3c55
SHA512 6a5113ce01d1b4e01c83efeb04fed9e1b50f589128b30b76a4c1777f13c60bf5903ee5dae90c4cd011828c39cd19098cc8219aa0a4368cca745b1432b06274c9
SSDEEP 98304:/H9DGHU7dlw9Ahji5c4LZa/AFptlYsQBOqUk+Wtzv8bTahPaxp81:fFGLR9QggtzUbOExq1
TLSH
T147B65B02BA6F54ECD59BC47483068A239E2174DB0B36BAEF418446393F6ABF05B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5661548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

IT_solutions.pdb

crypt32

CertEnumCertificatesInStore CertDuplicateStore CertAddCertificateContextToStore CertGetCertificateChain CertDuplicateCertificateContext CryptUnprotectData CryptProtectData CryptStringToBinaryA CertCreateCertificateContext CertOpenStore CertFreeCertificateChain CertDuplicateCertificateChain CertCloseStore CertVerifyCertificateChainPolicy CertFreeCertificateContext

kernel32

Sleep GetCurrentProcessId GetUserDefaultGeoName GetLocaleInfoEx MoveFileExW CreateToolhelp32Snapshot Process32NextW Process32FirstW SetFilePointerEx ProcessIdToSessionId OpenProcess TerminateProcess GetCurrentThreadId HeapReAlloc GetSystemInfo GetProcessId GetExitCodeProcess GetLogicalDrives LocalFree GetProcessTimes QueryFullProcessImageNameW CreateJobObjectW SetInformationJobObject FlushFileBuffers CreateMutexW AssignProcessToJobObject GetSystemTimePreciseAsFileTime CreatePipe SetHandleInformation CreatePseudoConsole InitializeProcThreadAttributeList UpdateProcThreadAttribute ClosePseudoConsole DeleteProcThreadAttributeList CreateProcessW ResumeThread ResizePseudoConsole WriteFile GlobalSize GlobalLock GlobalUnlock FindNextFileW GlobalAlloc GlobalFree CompareStringOrdinal GetTimeZoneInformationForYear AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetQueuedCompletionStatusEx GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW CancelIoEx CreateFileW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP QueryPerformanceCounter WriteConsoleW HeapAlloc GetEnvironmentVariableW WriteFileEx SleepEx ReadFileEx FormatMessageW GetModuleHandleA GetFullPathNameW SetWaitableTimer SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW CancelIo GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetCommandLineW RemoveDirectoryW DeleteFileW CopyFileExW QueryPerformanceFrequency ReadFile GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException PostQueuedCompletionStatus TerminateJobObject SwitchToThread OutputDebugStringA OutputDebugStringW FormatMessageA WaitForSingleObject SetFileTime CreateWaitableTimerExW FindClose CloseHandle GetLastError CreateThread HeapFree GetProcessHeap MultiByteToWideChar UnmapViewOfFile GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceA HeapCreate AreFileApisANSI GetFileAttributesA GetFileAttributesExW FreeLibrary GetTempPathA CreateFileA DeleteFileA SystemTimeToFileTime LoadLibraryW HeapCompact HeapDestroy HeapSize GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile GetTickCount FlushViewOfFile UnlockFile LockFileEx GetDiskFreeSpaceW GetFileSize HeapValidate

advapi32

SystemFunction036

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

user32

EmptyClipboard SetClipboardData IsClipboardFormatAvailable SetThreadDesktop CloseDesktop GetForegroundWindow GetWindowThreadProcessId GetClassNameW IsWindow IsWindowVisible GetWindowRect EnumDesktopWindows GetDpiForWindow SetThreadDpiAwarenessContext PrintWindow GetAncestor SendMessageTimeoutW AttachThreadInput GetThreadDesktop GetGUIThreadInfo PostMessageW BringWindowToTop SetActiveWindow SetFocus ScreenToClient GetClipboardSequenceNumber GetDC ReleaseDC GetWindowTextLengthW GetWindowTextW SendInput MapVirtualKeyW GetKeyboardState SetKeyboardState OpenClipboard RegisterSuspendResumeNotification GetSystemMetrics FindWindowExW CreateDesktopW PeekMessageW CreateWindowExW AddClipboardFormatListener GetClipboardData CloseClipboard GetClipboardOwner RemoveClipboardFormatListener DestroyWindow ChildWindowFromPointEx OpenInputDesktop

cfgmgr32

CM_Unregister_Notification CM_Register_Notification

ole32

CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SysStringLen SysFreeString VariantClear

wtsapi32

WTSSendMessageW WTSRegisterSessionNotification WTSUnRegisterSessionNotification

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wintrust

WinVerifyTrust

gdi32

DeleteObject SelectObject CreateDIBSection StretchBlt SetStretchBltMode DeleteDC CreateCompatibleDC

iphlpapi

NotifyIpInterfaceChange

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

secur32

FreeCredentialsHandle AcquireCredentialsHandleA ApplyControlToken InitializeSecurityContextW DeleteSecurityContext FreeContextBuffer AcceptSecurityContext QueryContextAttributesW DecryptMessage EncryptMessage

ws2_32

freeaddrinfo ioctlsocket shutdown connect recv getsockopt closesocket WSAGetLastError send WSASend setsockopt getpeername getsockname WSAIoctl WSAStartup WSACleanup bind getaddrinfo WSASocketW

bcrypt

BCryptGenRandom

ntdll

NtReadFile NtCreateNamedPipeFile NtOpenFile NtWriteFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile

Name

.text

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_e7fba385298c6a09de2ed36dee523d17_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_qilin_rusty-stealer_satacom

crypt32

kernel32

advapi32

rstrtmgr

user32

cfgmgr32

ole32

oleaut32

wtsapi32

version

wintrust

gdi32

iphlpapi

bcryptprimitives

api-ms-win-core-synch-l1-2-0

secur32

ws2_32

bcrypt

ntdll

generic