2026-07-02_fab1c72092257214cd5db051f7561577_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_fab1c72092257214cd5db051f7561577_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 2.9MB
Sample260702-thcvxset6n
SHA256 05cba94cec5e32e4f7bfe5f520eebc6ee2e1369c2a994acb64ce8df20d33dd15
MD5 fab1c72092257214cd5db051f7561577
SHA1 56c6abf42267ec3a5e2563517bf8194a0ffa7eaf
SHA512 b53020f1f2d2ab63b78fd6342bfce844c6192de793d0fb365f233796a1fddc1283ee3461bf380072a581efa59edacb658e89d9fc8e0e204b5100980ceb33ffa0
SSDEEP 49152:g4e5qjzCPGCdrFSypzatZygstu1cG5Pw9ztG3/xLvEI:h0YEXs/xI
TLSH
T15FE517217A4A99EDC54AC07483468A72693230DB0F35BAFF44C496793F7AAF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_fab1c72092257214cd5db051f7561577_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-02_fab1c72092257214cd5db051f7561577_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 2.9MB

2026-07-02_fab1c72092257214cd5db051f7561577_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH acfa6673e6872b2f50dc31c227a63990
SHA256 05cba94cec5e32e4f7bfe5f520eebc6ee2e1369c2a994acb64ce8df20d33dd15
MD5 fab1c72092257214cd5db051f7561577
SHA1 56c6abf42267ec3a5e2563517bf8194a0ffa7eaf
SHA512 b53020f1f2d2ab63b78fd6342bfce844c6192de793d0fb365f233796a1fddc1283ee3461bf380072a581efa59edacb658e89d9fc8e0e204b5100980ceb33ffa0
SSDEEP 49152:g4e5qjzCPGCdrFSypzatZygstu1cG5Pw9ztG3/xLvEI:h0YEXs/xI
TLSH
T15FE517217A4A99EDC54AC07483468A72693230DB0F35BAFF44C496793F7AAF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2012256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cute_app.pdb

kernel32

GetProcessTimes GetProcessIoCounters OpenProcess CreateEventW CreateFileW VirtualQueryEx WaitForSingleObject SetNamedPipeHandleState GetModuleHandleA LocalFree GlobalMemoryStatusEx GetCurrentProcessId GetSystemInfo SetFileCompletionNotificationModes GetQueuedCompletionStatusEx FreeLibrary GetProcAddress LoadLibraryExW GetComputerNameExW CreateIoCompletionPort CancelIoEx FormatMessageW WriteFile GetLastError LoadLibraryExA ReadFile GetExitCodeProcess GetSystemTimes PostQueuedCompletionStatus GetOverlappedResult SetHandleInformation DuplicateHandle GetCurrentProcess GetModuleHandleW GetSystemTimeAsFileTime HeapAlloc HeapFree GetProcessHeap Sleep CloseHandle WaitForMultipleObjects GetFileAttributesW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread lstrlenW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee InitializeSListHead GetStdHandle CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ReadFileEx CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal ReadProcessMemory SetUnhandledExceptionFilter AddVectoredExceptionHandler K32GetPerformanceInfo

advapi32

IsValidSid GetUserNameW SystemFunction036 GetLengthSid CopySid GetTokenInformation RegOpenKeyExW RegQueryValueExW RegCreateKeyTransactedW OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyTransactedW

oleaut32

SysFreeString SysStringLen GetErrorInfo

bcrypt

BCryptGenRandom

secur32

FreeCredentialsHandle ApplyControlToken DecryptMessage EncryptMessage AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA

ws2_32

closesocket WSAGetLastError getaddrinfo shutdown bind WSASocketW WSAIoctl connect setsockopt send WSASend recv getpeername getsockopt getsockname freeaddrinfo WSACleanup WSAStartup ioctlsocket

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateChain CertCloseStore CertFreeCertificateChain CertOpenStore CertFreeCertificateContext CertAddCertificateContextToStore CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateStore

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtQuerySystemInformation NtCancelIoFileEx RtlGetVersion NtQueryInformationProcess NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile NtCreateFile

bcryptprimitives

ProcessPrng

shell32

CommandLineToArgvW

pdh

PdhAddEnglishCounterW PdhOpenQueryA PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetProcessMemoryInfo GetModuleFileNameExW

vcruntime140

_CxxThrowException memset memmove __CxxFrameHandler3 memcpy __current_exception __current_exception_context memcmp __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _set_app_type _crt_atexit terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _seh_filter_exe _exit exit _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_fab1c72092257214cd5db051f7561577_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

oleaut32

bcrypt

secur32

ws2_32

crypt32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

shell32

pdh

powrprof

psapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic