2026-05-22_0efb123424b3cac015eae55cf51fea63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-22_0efb123424b3cac015eae55cf51fea63_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 627KB
Sample260522-cs4b7acv7m
SHA256 49f02019603700c864c94b5066bc9086200a1bff63d59cc9a80ac80fa2e1622c
MD5 0efb123424b3cac015eae55cf51fea63
SHA1 b9de4217905c725cbc95c5cd33a9b0c5268bc6eb
SHA512 a1fad88a23a86fd7c1f8d0028f79a704684645049eda9ee24f89e29d24b9f7601e1c598149c1360350c80ac83e25366870dabfbf59326adabdf40d5c1c0c2966
SSDEEP 12288:sxlu4r169BClK2gHp0DdORCKYPhVpe/tkEDK:sXTMBClrDdWCKYg/o
TLSH
T11DD44C03FA8445FDD09AC034C356C673AA76BC8A0731BAEF479466212F29EE51F2D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_0efb123424b3cac015eae55cf51fea63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-05-22_0efb123424b3cac015eae55cf51fea63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 627KB

2026-05-22_0efb123424b3cac015eae55cf51fea63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH f6686828032dc93282e826a98800026d
SHA256 49f02019603700c864c94b5066bc9086200a1bff63d59cc9a80ac80fa2e1622c
MD5 0efb123424b3cac015eae55cf51fea63
SHA1 b9de4217905c725cbc95c5cd33a9b0c5268bc6eb
SHA512 a1fad88a23a86fd7c1f8d0028f79a704684645049eda9ee24f89e29d24b9f7601e1c598149c1360350c80ac83e25366870dabfbf59326adabdf40d5c1c0c2966
SSDEEP 12288:sxlu4r169BClK2gHp0DdORCKYPhVpe/tkEDK:sXTMBClrDdWCKYg/o
TLSH
T11DD44C03FA8445FDD09AC034C356C673AA76BC8A0731BAEF479466212F29EE51F2D758
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

441068

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agent.pdb

kernel32

GetFullPathNameW CreateFileW SetFileTime ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile CreateProcessW GetFileAttributesW DuplicateHandle GetQueuedCompletionStatusEx WaitForMultipleObjects GetFinalPathNameByHandleW SetLastError PostQueuedCompletionStatus UnregisterWaitEx GetCurrentThread CreateIoCompletionPort FreeLibrary SetThreadStackGuarantee FindNextFileW FindFirstFileExW GetFileInformationByHandle GetModuleHandleA GetProcAddress SetFileCompletionNotificationModes WriteFileEx SleepEx SetUnhandledExceptionFilter SwitchToThread ReadFileEx Sleep WaitForSingleObjectEx WriteConsoleW GetCurrentThreadId GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId GetSystemInfo AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW LoadLibraryExA SetFileInformationByHandle GetFileInformationByHandleEx SetHandleInformation DeleteFileW GetCurrentProcess RegisterWaitForSingleObject FindClose GetSystemTimeAsFileTime GetExitCodeProcess WaitForSingleObject GetLastError TerminateProcess CloseHandle InitializeSListHead CreateThread GetTimeZoneInformationForYear

ws2_32

bind WSAIoctl WSAStartup WSACleanup WSASocketW getaddrinfo freeaddrinfo recv connect ioctlsocket socket WSAGetLastError send closesocket getsockopt

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtWriteFile

oleaut32

GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

user32

GetMonitorInfoW EnumDisplayMonitors EnumDisplaySettingsExW

gdi32

SelectObject GetObjectW StretchBlt GetDeviceCaps CreateDCW DeleteDC CreateCompatibleDC SetStretchBltMode DeleteObject GetDIBits CreateCompatibleBitmap

vcruntime140

memset memcmp __CxxFrameHandler3 __current_exception_context __current_exception __C_specific_handler memcpy memmove

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _initialize_narrow_environment _crt_atexit _initterm terminate __p___argc __p___argv _cexit _seh_filter_exe _register_onexit_function _initialize_onexit_table _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _exit _get_initial_narrow_environment _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_0efb123424b3cac015eae55cf51fea63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

ntdll

oleaut32

bcryptprimitives

user32

gdi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic