2026-11-12_4968d987b972c8dc291eff7b3431ba66_akira_blankgrabber_cobalt-strike_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_4968d987b972c8dc291eff7b3431ba66_akira_blankgrabber_cobalt-strike_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_satacom
Size 18.7MB
Sample261113-eed69aft4x
SHA256 b0d619fe0e68c1a70254ca41471b5e400f158f8da4697e5684d7ea5c7cb38066
MD5 4968d987b972c8dc291eff7b3431ba66
SHA1 5035422b42523a8ca96de3b45159aa7f945afa27
SHA512 f8bb05b7f6889e07f56a584862f99c2f73cd9e4290028750c300338a331b587147a49911c1c6acef5aaaf0699463388cb0a645438b4001cd5a407fd5fd5e4856
SSDEEP 196608:R81fegD+vjzSNsrCmrJ1wvMCZStEtu/UrWTOrNGBaFHg9ShLyNR:K/D+PSC/rJVCAtEtu/UrWTOrNGOgt
TLSH
T1031739217A9A99ECC56AC470C34A8A735E6170CB0B35BAFF44D446393E6AAF41F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-12_4968d987b972c8dc291eff7b3431ba66_akira_blankgrabber_cobalt-strike_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_satacom

.exe 18.7MB

2026-11-12_4968d987b972c8dc291eff7b3431ba66_akira_blankgrabber_cobalt-strike_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_satacom

IMPHASH 76e0dff455d9768b36dc0a4c514b20cb
SHA256 b0d619fe0e68c1a70254ca41471b5e400f158f8da4697e5684d7ea5c7cb38066
MD5 4968d987b972c8dc291eff7b3431ba66
SHA1 5035422b42523a8ca96de3b45159aa7f945afa27
SHA512 f8bb05b7f6889e07f56a584862f99c2f73cd9e4290028750c300338a331b587147a49911c1c6acef5aaaf0699463388cb0a645438b4001cd5a407fd5fd5e4856
SSDEEP 196608:R81fegD+vjzSNsrCmrJ1wvMCZStEtu/UrWTOrNGBaFHg9ShLyNR:K/D+PSC/rJVCAtEtu/UrWTOrNGOgt
TLSH
T1031739217A9A99ECC56AC470C34A8A735E6170CB0B35BAFF44D446393E6AAF41F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

20:26:57:5e:e6:36:8f:fe:f4:c7:fd:d1:22:98:46:98:0d:9d:28:79:84:83:d2:c3:3d:23:6c:c9:e8:a8:08:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Chains

Nov 8, 2026

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=OpenAI OpCo\, LLC,O=OpenAI OpCo\, LLC,L=San Francisco,ST=California,C=US

Serial Number

33:00:0b:40:18:0d:f1:f0:66:e9:1e:44:da:00:00:00:0b:40:18

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2026 - Nov 9, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5e:2e:11:6e:1c:76:9c:ef:05:00:00:00:00:00:5e

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

13145984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_windows_sandbox_setup.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CancelIoEx CloseHandle CompareStringOrdinal CompareStringW ConnectNamedPipe CreateDirectoryW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreateNamedPipeW CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTimeFormatW GetTimeZoneInformation GetTimeZoneInformationForYear GetWindowsDirectoryW GlobalFree HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MoveFileExA MultiByteToWideChar OpenMutexW OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SleepEx SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

advapi32

BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext EqualSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSecurityInfo LookupAccountNameW LookupAccountSidW MapGenericMask RegCloseKey RegCreateKeyExW RegCreateKeyTransactedW RegGetValueW RegOpenKeyExW RegOpenKeyTransactedW RegQueryValueExW RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo SystemFunction036

oleaut32

GetErrorInfo SysAllocStringLen SysFreeString SysStringLen

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitSecurityInterfaceA InitializeSecurityContextW QueryContextAttributesW

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertCreateCertificateContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetEnhancedKeyUsage CertGetNameStringA CertOpenStore CertVerifyCertificateChainPolicy CertVerifyTimeValidity CryptDecodeObjectEx CryptProtectData CryptQueryObject CryptStringToBinaryA PFXImportCertStore

ole32

CoCreateInstance CoInitializeEx CoUninitialize

combase

CoTaskMemFree

fwpuclnt

FwpmEngineClose0 FwpmEngineOpen0 FwpmFilterAdd0 FwpmFilterDeleteByKey0 FwpmProviderAdd0 FwpmSubLayerAdd0 FwpmTransactionAbort0 FwpmTransactionBegin0 FwpmTransactionCommit0

user32

GetSystemMetrics

netapi32

NetApiBufferFree NetLocalGroupAdd NetLocalGroupAddMembers NetUserAdd NetUserGetInfo NetUserSetInfo

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtSetInformationFile NtWriteFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

shell32

SHGetKnownFolderPath

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSADuplicateSocketW WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASend WSASetLastError WSASocketW WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt htonl htons ioctlsocket listen ntohs recv select send setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

iphlpapi

if_nametoindex

Name

.text

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

610KB

Virtual Size

609KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

817B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_4968d987b972c8dc291eff7b3431ba66_akira_blankgrabber_cobalt-strike_glassworm_icedid_megazord_njrat_quasar-rat_rusty-stealer_ryuk_satacom

kernel32

advapi32

oleaut32

secur32

bcrypt

crypt32

ole32

combase

fwpuclnt

user32

netapi32

ntdll

bcryptprimitives

shell32

ws2_32

api-ms-win-core-synch-l1-2-0

winhttp

iphlpapi

generic