2026-05-27_d1338cf21c11148b79e08512f713b01a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-27_d1338cf21c11148b79e08512f713b01a_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 9.0MB
Sample260527-ej7dlaht4z
SHA256 4705cfba200a5d90d81c5f97afb5ee7cc64ea5cf6beab0c1bee87621a15a77a2
MD5 d1338cf21c11148b79e08512f713b01a
SHA1 539aaeec4a11fdbecbfca3be5acf878e584c8f37
SHA512 288db46f58590c64466315ccfd8b37bdd6341841ff136c32d45c53c453176327f7a5b8e376319651a99c74d71943513dd08417d5f4c238c305e89b1af096dd81
SSDEEP 98304:BDMDZADtaA/XKU/6mJpsl/KZqwyZddvf+rCzzu2nqpZUHXHPi8NwKMqdsj5EK4JL:GiDzzpCzNqvU3v/wK8dEK4JJ9LrwG
TLSH
T11D96BF07E29081F9C0AEC178C35BA637EB32B88A4535B29F5BE44B512F26F506F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-27_d1338cf21c11148b79e08512f713b01a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-05-27_d1338cf21c11148b79e08512f713b01a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 9.0MB

2026-05-27_d1338cf21c11148b79e08512f713b01a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 470e6d10cd3b5473686b34f72e31edf1
SHA256 4705cfba200a5d90d81c5f97afb5ee7cc64ea5cf6beab0c1bee87621a15a77a2
MD5 d1338cf21c11148b79e08512f713b01a
SHA1 539aaeec4a11fdbecbfca3be5acf878e584c8f37
SHA512 288db46f58590c64466315ccfd8b37bdd6341841ff136c32d45c53c453176327f7a5b8e376319651a99c74d71943513dd08417d5f4c238c305e89b1af096dd81
SSDEEP 98304:BDMDZADtaA/XKU/6mJpsl/KZqwyZddvf+rCzzu2nqpZUHXHPi8NwKMqdsj5EK4JL:GiDzzpCzNqvU3v/wK8dEK4JJ9LrwG
TLSH
T11D96BF07E29081F9C0AEC178C35BA637EB32B88A4535B29F5BE44B512F26F506F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4199616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Real.pdb

kernel32

GetFullPathNameW GetUserDefaultUILanguage FindClose LoadLibraryW LoadLibraryA ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateMutexW WakeAllConditionVariable GetModuleHandleW RemoveDirectoryW SleepEx GetVolumeInformationW GetSystemFirmwareTable SleepConditionVariableSRW GetSystemTimeAsFileTime SetLastError K32GetPerformanceInfo FreeEnvironmentStringsW GetEnvironmentStringsW LCIDToLocaleName QueryPerformanceFrequency GetCommandLineW TerminateProcess WaitForSingleObject GetExitCodeProcess CompareStringOrdinal LocalFree RtlPcToFileHeader FlushFileBuffers CreateEventW OpenProcess RaiseException FlsAlloc FlsGetValue GlobalAlloc GlobalLock GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind GlobalUnlock RtlCaptureContext QueryPerformanceCounter GlobalFree SetEnvironmentVariableW GetCurrentProcessId AddVectoredExceptionHandler FlsSetValue FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter SetFileCompletionNotificationModes CreateFileW RtlUnwindEx SwitchToThread RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess CreateMutexA WideCharToMultiByte MultiByteToWideChar lstrlenW CreateDirectoryW FindFirstFileExW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx SetFilePointerEx FormatMessageW GetModuleFileNameW GetTempPathW SetHandleInformation DeleteFileW GetFinalPathNameByHandleW CopyFileExW MoveFileExW CreateThread GetSystemTimePreciseAsFileTime GetSystemInfo CreateWaitableTimerExW SetWaitableTimer ExitProcess GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle WaitForMultipleObjects FindNextFileW GetSystemTimes GetProcessIoCounters HeapReAlloc GetProcessTimes GetCurrentThread ReadProcessMemory SetThreadStackGuarantee VirtualQueryEx GlobalMemoryStatusEx GetModuleHandleA Sleep CancelIo ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle WriteFileEx DeviceIoControl CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx DeleteCriticalSection ReadFile PostQueuedCompletionStatus WriteFile GetOverlappedResult GetProcAddress GetLastError GetCurrentThreadId InitializeCriticalSectionEx LoadLibraryExW OutputDebugStringW OutputDebugStringA FreeLibrary LoadLibraryExA HeapAlloc CloseHandle HeapFree ReleaseMutex GetProcessHeap

advapi32

RegQueryValueExW RegGetValueW RegDeleteValueW RegCreateKeyTransactedW RegCreateKeyExW CreateProcessWithTokenW DuplicateTokenEx RegOpenKeyTransactedW RegOpenKeyExW IsValidSid GetLengthSid RegCloseKey RegDeleteTreeW RegSetValueExW GetTokenInformation CopySid OpenProcessToken SystemFunction036 EventUnregister EventWriteTransfer EventSetInformation EventRegister CredWriteW CredDeleteW CredFree CredReadW

bcryptprimitives

ProcessPrng

ntdll

NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile RtlNtStatusToDosError NtWriteFile NtOpenFile NtCreateNamedPipeFile RtlGetVersion NtQueryInformationProcess NtQuerySystemInformation

shell32

Shell_NotifyIconGetRect SHOpenFolderAndSelectItems ILCreateFromPathW SetCurrentProcessExplicitAppUserModelID ILFree DragQueryFileW SHGetPropertyStoreForWindow ShellExecuteExW CommandLineToArgvW ShellExecuteW SHAppBarMessage SHGetKnownFolderPath Shell_NotifyIconW DragFinish SHCreateItemFromParsingName

ole32

OleInitialize CoInitializeEx RevokeDragDrop RegisterDragDrop CoInitialize CoTaskMemFree CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemAlloc CoUninitialize

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

gdi32

DeleteObject SetTextColor CreateCompatibleDC SetBkMode CreateSolidBrush CreateDIBSection BitBlt CombineRgn SelectObject DeleteDC CreateRectRgn GetDeviceCaps

comctl32

TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass DefSubclassProc

user32

SetWindowLongW GetSystemMenu ShowCursor GetMonitorInfoW ClipCursor GetClipCursor MapVirtualKeyExW SetWindowPlacement GetKeyState ChangeDisplaySettingsExW RegisterRawInputDevices AdjustWindowRectEx GetKeyboardLayout DestroyMenu DestroyIcon DestroyAcceleratorTable CreateAcceleratorTableW CreateMenu CreatePopupMenu DrawMenuBar GetMenu GetWindowLongW InvalidateRgn ToUnicodeEx ReleaseCapture MonitorFromRect SetMenuItemInfoW CreateIcon SetWindowDisplayAffinity SetCapture SetFocus RemoveMenu SetMenu GetActiveWindow PostMessageW SystemParametersInfoA PostQuitMessage GetWindow RegisterWindowMessageA MonitorFromPoint EnumDisplayMonitors SetTimer KillTimer GetKeyboardState TranslateAcceleratorW GetParent ChangeWindowMessageFilterEx RegisterClassW SetWindowRgn CloseClipboard SetPropW FindWindowExW EmptyClipboard OpenClipboard GetClipboardData SetClipboardData CallNextHookEx GetAsyncKeyState UnhookWindowsHookEx SetWindowsHookExW IsWindowVisible CloseTouchInputHandle GetTouchInputInfo ScreenToClient GetWindowThreadProcessId TrackMouseEvent SystemParametersInfoW FlashWindowEx LoadCursorW SetCursor IsIconic EnumWindows SetParent RegisterTouchWindow IsWindow SetCursorPos UnregisterHotKey RegisterHotKey FindWindowW DefWindowProcW UpdateWindow InvalidateRect GetForegroundWindow IsWindowEnabled MsgWaitForMultipleObjectsEx DispatchMessageW PostThreadMessageW MapVirtualKeyW GetUpdateRect PeekMessageW ValidateRect GetRawInputData GetMessageW SetWindowLongPtrW GetSystemMetrics SetWindowTextW EnableWindow EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW GetWindowTextW GetWindowLongPtrW RedrawWindow AdjustWindowRect DestroyWindow GetWindowTextLengthW IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW ShowWindow SendMessageW GetWindowPlacement

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

shlwapi

SHCreateMemStream

crypt32

CryptUnprotectData CryptProtectData

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

ws2_32

shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup bind setsockopt WSASend connect ioctlsocket WSASocketW closesocket recv WSAIoctl getsockname WSAGetLastError getpeername getsockopt

iphlpapi

GetAdaptersAddresses

pdh

PdhRemoveCounter PdhAddEnglishCounterW PdhCloseQuery PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryA

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

pow roundf __setusermatherr trunc round floor

api-ms-win-crt-string-l1-1-0

strlen strcpy_s _wcsicmp wcslen wcscmp

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initterm _wassert _set_app_type _exit _configure_narrow_argv _register_onexit_function _initialize_narrow_environment _c_exit _seh_filter_exe _register_thread_local_exe_atexit_callback __p___argc _initialize_onexit_table _cexit abort _get_initial_narrow_environment _crt_atexit terminate __p___argv

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode malloc _callnewh

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_d1338cf21c11148b79e08512f713b01a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

bcryptprimitives

ntdll

shell32

ole32

bcrypt

api-ms-win-core-synch-l1-2-0

gdi32

comctl32

user32

dwmapi

shlwapi

crypt32

oleaut32

ws2_32

iphlpapi

pdh

psapi

powrprof

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic