2026-05-29_b5d4e31af5c0ce24d8b1e257e3107675_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_b5d4e31af5c0ce24d8b1e257e3107675_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 6.9MB
Sample260529-v1j8dsds4l
SHA256 d7c9efe83a46acea1c8a012e0ac0b697c3b6bc282d192d2b07cf2361d8fd8345
MD5 b5d4e31af5c0ce24d8b1e257e3107675
SHA1 7981d11ffcee35bb7d13904e5efd43d238326b67
SHA512 be4587dd69fe7d912db10245dc53f345dfd442826b043e32c72d613044c56cf7d870eee16cf0cf272abb3591c6bdc03a7591c4fb59fad1420726af9480473e05
SSDEEP 49152:9M584zCbQxOdkGtexoc6xLqnMKD8bnGfc93iCdFZvw6ieZJwvv14ZEtlxipcLZbX:KrgrJ5uScv14ZslW1L5KGkGG3++h
TLSH
T117764C17BBA655E9D1BBC4349392523BF93170DA0B34A6EB45C0462E2F22BF49E3D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_b5d4e31af5c0ce24d8b1e257e3107675_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

File Explorer

2026-05-29_b5d4e31af5c0ce24d8b1e257e3107675_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

.exe 6.9MB

2026-05-29_b5d4e31af5c0ce24d8b1e257e3107675_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

IMPHASH fc9e7b5527c41aa73160ad4689a75c33
SHA256 d7c9efe83a46acea1c8a012e0ac0b697c3b6bc282d192d2b07cf2361d8fd8345
MD5 b5d4e31af5c0ce24d8b1e257e3107675
SHA1 7981d11ffcee35bb7d13904e5efd43d238326b67
SHA512 be4587dd69fe7d912db10245dc53f345dfd442826b043e32c72d613044c56cf7d870eee16cf0cf272abb3591c6bdc03a7591c4fb59fad1420726af9480473e05
SSDEEP 49152:9M584zCbQxOdkGtexoc6xLqnMKD8bnGfc93iCdFZvw6ieZJwvv14ZEtlxipcLZbX:KrgrJ5uScv14ZslW1L5KGkGG3++h
TLSH
T117764C17BBA655E9D1BBC4349392523BF93170DA0B34A6EB45C0462E2F22BF49E3D344
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4406144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gh.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ws2_32

freeaddrinfo getaddrinfo WSASend getsockname getpeername WSAGetLastError socket connect WSAIoctl WSASocketW bind shutdown recv ioctlsocket closesocket setsockopt send getsockopt WSACleanup WSAStartup

kernel32

GetProcAddress GetModuleHandleA Sleep CloseHandle CreateIoCompletionPort SetHandleInformation GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetCurrentProcess GetLastError SetFileCompletionNotificationModes TlsSetValue SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue GetSystemTimeAsFileTime RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo GetCurrentThreadId QueryPerformanceCounter CreateThread GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar HeapAlloc QueryPerformanceFrequency SetUnhandledExceptionFilter InitializeSListHead GetModuleHandleW GetFullPathNameW GetConsoleMode FindClose FindFirstFileExW GetFinalPathNameByHandleW GetFileInformationByHandle CreateFileW SwitchToThread GetFileInformationByHandleEx CreateDirectoryW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject FormatMessageW RtlVirtualUnwind FormatMessageA GetProcessHeap HeapFree HeapReAlloc lstrlenW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFileInformationByHandle

ntdll

RtlNtStatusToDosError NtCreateFile NtCancelIoFileEx NtWriteFile NtDeviceIoControlFile

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

vcruntime140

__current_exception __current_exception_context __CxxFrameHandler3 __C_specific_handler _CxxThrowException strchr memcpy memset memmove memcmp memchr

api-ms-win-crt-string-l1-1-0

_strdup strlen strncmp strcmp

api-ms-win-crt-math-l1-1-0

pow __setusermatherr log2f

api-ms-win-crt-heap-l1-1-0

realloc malloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fseek fread fflush fgets ferror feof fclose _write _read _lseek _close __stdio_common_vsscanf ftell fputs __stdio_common_vsprintf fwrite _set_fmode __p__commode fopen

api-ms-win-crt-time-l1-1-0

_ftime64 _time64

api-ms-win-crt-runtime-l1-1-0

_wassert _initialize_onexit_table _register_onexit_function terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argc _errno _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type abort __p___argv _seh_filter_exe strerror

api-ms-win-crt-utility-l1-1-0

qsort qsort_s bsearch

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_b5d4e31af5c0ce24d8b1e257e3107675_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

ws2_32

kernel32

ntdll

bcryptprimitives

advapi32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic