2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 1.8MB
Sample260108-emn2esvlcm
SHA256 9794f1982d73c0ad8ecf5fdfa85c95a991a8a954c3efb6c5744e858b31b74ded
MD5 d48bedaddb5c37d8028367c3225fda0b
SHA1 b143593dcbb3db9a1ffdff19eb4f268f2929c85c
SHA512 ad282e1fb6ec157d73b75cedae424be2a4c2140cb1b5f6975c483e4cf19247653d6162facea18cef8b7a962bade6f513c4db3bf1a300495249d8d81a6679e3c5
SSDEEP 24576:aWv+/j1/O5q+nnYamU15376GyRtxz34ErMO0TpjRFM3VIH06iydo1:aWv+/jdX+nnXmU15Itr3rMNRYIU6i1
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 1.8MB

2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH 18590507fa746042d437d07fc24cf9f6
SHA256 9794f1982d73c0ad8ecf5fdfa85c95a991a8a954c3efb6c5744e858b31b74ded
MD5 d48bedaddb5c37d8028367c3225fda0b
SHA1 b143593dcbb3db9a1ffdff19eb4f268f2929c85c
SHA512 ad282e1fb6ec157d73b75cedae424be2a4c2140cb1b5f6975c483e4cf19247653d6162facea18cef8b7a962bade6f513c4db3bf1a300495249d8d81a6679e3c5
SSDEEP 24576:aWv+/j1/O5q+nnYamU15376GyRtxz34ErMO0TpjRFM3VIH06iydo1:aWv+/jdX+nnXmU15Itr3rMNRYIU6i1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

04:f7:b2:5d:6d:20:32:08:5a:a8:c2:6d:9d:21:82:7d:c0:31:3c:12:84:24:82:08:25:2b:32:74:ad:82:4a:03

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 2, 2025

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:c7:e4:7f:1a:03:94:d6:db:cc:00:00:00:00:04:c7

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 14, 2024 - Nov 12, 2025

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

1070480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rustload.pdb

kernel32

HeapSize LCMapStringW CompareStringW SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx LoadLibraryExW VirtualProtect CreateIoCompletionPort SetFileCompletionNotificationModes GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW SetConsoleCtrlHandler GetEnvironmentStringsW SetHandleInformation GetCPInfo GetStdHandle GetConsoleMode SwitchToThread GetOEMCP ReleaseSemaphore GetCurrentThreadId WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId CreateMutexA ReleaseMutex CreateSemaphoreA GetACP IsValidCodePage CreateThread CreateWaitableTimerExW SetWaitableTimer Sleep UnhandledExceptionFilter PostQueuedCompletionStatus IsDebuggerPresent GetCommandLineW GetCommandLineA GetModuleHandleExW GetCurrentThread GetModuleFileNameW RtlPcToFileHeader GetConsoleOutputCP CloseHandle GetModuleHandleA GetProcAddress AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc WriteConsoleW WaitForSingleObject GetSystemTimePreciseAsFileTime MultiByteToWideChar GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA lstrlenW WideCharToMultiByte RtlVirtualUnwind GetEnvironmentVariableW HeapAlloc GetModuleHandleW FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter SetThreadStackGuarantee GetLastError GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree WriteFile ExitProcess TerminateProcess FreeLibrary IsProcessorFeaturePresent FindClose FindFirstFileExW FindNextFileW SetStdHandle GetFileType FlushFileBuffers SetFilePointerEx CreateFileW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSAStartup getaddrinfo WSACleanup bind setsockopt getsockopt freeaddrinfo ioctlsocket WSASocketW closesocket recv WSAIoctl send shutdown WSASend getpeername getsockname WSAGetLastError connect

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtCancelIoFileEx

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

618KB

Virtual Size

617KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

828B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-01-08_d48bedaddb5c37d8028367c3225fda0b_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcryptprimitives

bcrypt

advapi32

generic