2026-06-27_d2d418b2ec3a9d670f10f1bfa49262c1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_d2d418b2ec3a9d670f10f1bfa49262c1_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 5.2MB
Sample260629-c3c8rabv2x
SHA256 da5e0b39664186dee597a52199b02eb4d7fd2d3edd6fdef02387778cbbe953ab
MD5 d2d418b2ec3a9d670f10f1bfa49262c1
SHA1 ef4f36d3e4669e015b0bf7fe3c45d52428caa8dd
SHA512 207ca99752536f7b2060edee2c0e9b641270329cc29d3835e6c409f5d425cf50483711ba69428481738372ea9bd009fb699adaf1f2459fea996215571dfd0da8
SSDEEP 49152:THXtKnoI3spYQY01Kk67d8HthRAqSWrSYYS/hfw/TuTCUAoDpKLU9rluV43AtA4C:RehkAKA79CoVlMHmQu3OD9SAN
TLSH
T17446BF47FA9581E8C09EC178C3175227EB72BC8D4922B79B2BE88A113F57B205F5D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-06-27_d2d418b2ec3a9d670f10f1bfa49262c1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-06-27_d2d418b2ec3a9d670f10f1bfa49262c1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 5.2MB

2026-06-27_d2d418b2ec3a9d670f10f1bfa49262c1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 10ff7324ce07257677e748d9a55f0562
SHA256 da5e0b39664186dee597a52199b02eb4d7fd2d3edd6fdef02387778cbbe953ab
MD5 d2d418b2ec3a9d670f10f1bfa49262c1
SHA1 ef4f36d3e4669e015b0bf7fe3c45d52428caa8dd
SHA512 207ca99752536f7b2060edee2c0e9b641270329cc29d3835e6c409f5d425cf50483711ba69428481738372ea9bd009fb699adaf1f2459fea996215571dfd0da8
SSDEEP 49152:THXtKnoI3spYQY01Kk67d8HthRAqSWrSYYS/hfw/TuTCUAoDpKLU9rluV43AtA4C:RehkAKA79CoVlMHmQu3OD9SAN
TLSH
T17446BF47FA9581E8C09EC178C3175227EB72BC8D4922B79B2BE88A113F57B205F5D358
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5c:ea:a3:c4:c4:47:94:95:5a:8a:d3:b0:8d:2d:6f:2b:cd:ab:0d:57:1e:d3:1e:6b:14:84:1f:cb:e6:fc:2c:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Vextron,O=Vextron,L=Seattle,ST=Washington,C=US

Chains

Jun 20, 2026

CN=Vextron,O=Vextron,L=Seattle,ST=Washington,C=US

Subject

CN=Vextron,O=Vextron,L=Seattle,ST=Washington,C=US

Serial Number

46:97:71:8b:7e:e0:c8:88:4f:05:50:a4:2d:a8:c0:94

Issuer

CN=Vextron,O=Vextron,L=Seattle,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 6, 2026 - Jun 6, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

2529392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CertFreeCertificateContext CryptUnprotectData CertDuplicateCertificateContext CertDuplicateStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertCloseStore CertEnumCertificatesInStore

kernel32

LoadLibraryA CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP GetFinalPathNameByHandleW WriteConsoleW GetOverlappedResult ReadFileEx SleepEx WriteFileEx SetLastError WaitForSingleObjectEx SetHandleInformation CreateThread GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW WaitForMultipleObjects GetCurrentProcess CreateDirectoryW ExitProcess CreateEventW CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle WriteFile GetTempPathW DeleteFileW CopyFileExW WaitForSingleObject CancelIoEx FindNextFileW HeapReAlloc FindClose FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile GetQueuedCompletionStatusEx HeapCompact LoadLibraryW DeleteFileA GetModuleHandleA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI SwitchToThread GetCurrentThread SetThreadStackGuarantee PostQueuedCompletionStatus SetWaitableTimer ReadFile GetCommandLineW CreateWaitableTimerExW SetFileCompletionNotificationModes GetProcAddress GetFileInformationByHandle GetExitCodeProcess CreateFileW GetSystemTimePreciseAsFileTime SetCurrentDirectoryW AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetCurrentDirectoryW MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal FormatMessageA SystemTimeToFileTime OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection HeapDestroy CreateIoCompletionPort Sleep GetModuleFileNameW GetModuleHandleW GetCurrentThreadId GetCurrentProcessId GetTickCount64 GetSystemInfo GetConsoleWindow FormatMessageW GetLastError CloseHandle HeapFree HeapAlloc GetProcessHeap InitializeSListHead CreateFileA LocalFree SetFilePointerEx GetComputerNameExW GetFileInformationByHandleEx SetUnhandledExceptionFilter

advapi32

RegQueryValueExW SystemFunction036 RegOpenKeyExW RegCloseKey

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSAStartup closesocket WSACleanup WSASend recv bind getaddrinfo freeaddrinfo send WSASocketW WSAIoctl ioctlsocket getsockopt setsockopt shutdown getsockname WSAGetLastError getpeername connect

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtWriteFile NtReadFile NtOpenFile

bcrypt

BCryptGenRandom

secur32

DeleteSecurityContext EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle QueryContextAttributesW AcquireCredentialsHandleA

bcryptprimitives

ProcessPrng

user32

GetDC ReleaseDC GetWindowRect GetDesktopWindow ShowWindow

gdi32

GetDeviceCaps

shell32

ShellExecuteW

vcruntime140

memcmp memmove __current_exception_context __current_exception __C_specific_handler memset memchr strchr __CxxFrameHandler3 strrchr memcpy

api-ms-win-crt-string-l1-1-0

strspn strncmp strcspn strcmp strlen

api-ms-win-crt-math-l1-1-0

_dclass pow log2 __setusermatherr log fabs

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode free realloc malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _endthreadex _initterm _initterm_e exit _exit _beginthreadex __p___argc __p___argv _set_app_type _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function terminate _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_d2d418b2ec3a9d670f10f1bfa49262c1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

PE Signature issue

crypt32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

secur32

bcryptprimitives

user32

gdi32

shell32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic