2026-06-05_44bb71ea49fd31d4ed0a68461853abda_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-05_44bb71ea49fd31d4ed0a68461853abda_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 8.9MB
Sample260605-xtf89sd13n
SHA256 f1b3bb77bd20a36454492ee79a37ff6826bff55f2d1fbcd1ac55bc2c1c4b4942
MD5 44bb71ea49fd31d4ed0a68461853abda
SHA1 e0713e59f3c5e17df7734372d0c83cefa1c93de2
SHA512 db7f20543d6853f7251bf68158a52b1756cb3a07cf90e207f3967e9610a023695572c2babeb7f1820bef3dbfe7f89cf8dc1808ecf8f23b887b6bd23e160f782f
SSDEEP 98304:d5rhSNPK0aZQVmPijNvMTe2KDYc7afa/bA+oPGFCyz5KY:LrArVmYh6llyJ
TLSH
T1539639217A9A98ACC15AC474834A4A735A3130CB1B35BAFF44D496793F7AAF51F3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-05_44bb71ea49fd31d4ed0a68461853abda_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-06-05_44bb71ea49fd31d4ed0a68461853abda_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 8.9MB

2026-06-05_44bb71ea49fd31d4ed0a68461853abda_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 07964bf6a205a49f937ae96ab4deab9c
SHA256 f1b3bb77bd20a36454492ee79a37ff6826bff55f2d1fbcd1ac55bc2c1c4b4942
MD5 44bb71ea49fd31d4ed0a68461853abda
SHA1 e0713e59f3c5e17df7734372d0c83cefa1c93de2
SHA512 db7f20543d6853f7251bf68158a52b1756cb3a07cf90e207f3967e9610a023695572c2babeb7f1820bef3dbfe7f89cf8dc1808ecf8f23b887b6bd23e160f782f
SSDEEP 98304:d5rhSNPK0aZQVmPijNvMTe2KDYc7afa/bA+oPGFCyz5KY:LrArVmYh6llyJ
TLSH
T1539639217A9A98ACC15AC474834A4A735A3130CB1B35BAFF44D496793F7AAF51F3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6623312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

proviz_server.pdb

bcryptprimitives

ProcessPrng

kernel32

LocalFree LockFileEx GetFileSize GetCurrentProcessId FreeLibrary DeleteFileW SetNamedPipeHandleState CloseHandle GetLastError SetConsoleMode GetConsoleMode CreateFileW UnlockFile SystemTimeToFileTime DeleteFileA GetModuleHandleA GetProcAddress SetFileCompletionNotificationModes GetQueuedCompletionStatusEx WaitForSingleObjectEx CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep GetFileAttributesW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile GetFullPathNameW ReadFile AreFileApisANSI GetCurrentThreadId GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCurrentProcess CreateIoCompletionPort CancelIoEx GetOverlappedResult PostQueuedCompletionStatus SetHandleInformation FlushFileBuffers GetModuleFileNameW GetModuleHandleW GetFileType GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetStdHandle GetFileInformationByHandleEx GetFileInformationByHandle InitializeSListHead GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext CreateThread QueryPerformanceFrequency SetFileTime SetFileInformationByHandle SetLastError SetUnhandledExceptionFilter DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException HeapCreate HeapFree OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar FormatMessageW OutputDebugStringW FlushViewOfFile LoadLibraryA HeapReAlloc GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy GetProcessHeap WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount RtlVirtualUnwind

ws2_32

bind listen shutdown WSAIoctl accept getsockopt getpeername getsockname connect WSAGetLastError socket ioctlsocket setsockopt closesocket WSASocketW WSASend send recv freeaddrinfo WSAStartup WSACleanup getaddrinfo

advapi32

GetUserNameW SystemFunction036

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile NtCreateFile NtDeviceIoControlFile NtReadFile NtCancelIoFileEx

bcrypt

BCryptGenRandom

vcruntime140

memset memmove strrchr __current_exception __CxxFrameHandler3 __current_exception_context strchr __C_specific_handler _CxxThrowException memcmp memcpy memchr

api-ms-win-crt-string-l1-1-0

strspn strcmp strcspn strlen strncmp

api-ms-win-crt-heap-l1-1-0

realloc free malloc _msize _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

__p___argc _set_app_type _endthreadex _beginthreadex _configure_narrow_argv terminate _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _crt_atexit _seh_filter_exe __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

log __setusermatherr pow

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-05_44bb71ea49fd31d4ed0a68461853abda_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

ws2_32

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic