2026-07-05_bfb9944f0c72ffe8867f40c42256a9b4_akira_cobalt-strike_glassworm_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_bfb9944f0c72ffe8867f40c42256a9b4_akira_cobalt-strike_glassworm_satacom_vidar
Size 3.4MB
Sample260705-3cks1sb13p
SHA256 038c9c9c1864d8af4da15d6ce9088bd8fea7a954db7265c842c564dda3b7408b
MD5 bfb9944f0c72ffe8867f40c42256a9b4
SHA1 83ada0d1dd64ff05e9a3c6206174b18aa508be1c
SHA512 dee7cc2e7eceb1ec18107f30616a322c40c37d0bc7f349244fa02b4bf5ac79f1ae6b917b58da199066aeff1a8b985ff5300e73d74a07942fba1cb25752450e3e
SSDEEP 49152:sTgVJrEl4Wg+KrN1ch9NZnC+ifNlD+xvT3eDmQfdurZq:FVxwagLFq
TLSH
T1AFF56B03E69445EAD06AC178C75B9723FB71B88A0A21F7AF17D44A712F53BA06F1D309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_bfb9944f0c72ffe8867f40c42256a9b4_akira_cobalt-strike_glassworm_satacom_vidar

File Explorer

2026-07-05_bfb9944f0c72ffe8867f40c42256a9b4_akira_cobalt-strike_glassworm_satacom_vidar

.exe 3.4MB

2026-07-05_bfb9944f0c72ffe8867f40c42256a9b4_akira_cobalt-strike_glassworm_satacom_vidar

IMPHASH 8a8df6d61a3f738864291afb5d51f59f
SHA256 038c9c9c1864d8af4da15d6ce9088bd8fea7a954db7265c842c564dda3b7408b
MD5 bfb9944f0c72ffe8867f40c42256a9b4
SHA1 83ada0d1dd64ff05e9a3c6206174b18aa508be1c
SHA512 dee7cc2e7eceb1ec18107f30616a322c40c37d0bc7f349244fa02b4bf5ac79f1ae6b917b58da199066aeff1a8b985ff5300e73d74a07942fba1cb25752450e3e
SSDEEP 49152:sTgVJrEl4Wg+KrN1ch9NZnC+ifNlD+xvT3eDmQfdurZq:FVxwagLFq
TLSH
T1AFF56B03E69445EAD06AC178C75B9723FB71B88A0A21F7AF17D44A712F53BA06F1D309
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2526392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ramzi\source\repos\target\release\deps\nightmangle.pdb

advapi32

SetThreadToken RevertToSelf OpenProcessToken GetTokenInformation LookupAccountSidW LookupPrivilegeValueW AdjustTokenPrivileges GetSidSubAuthorityCount GetSidSubAuthority DuplicateTokenEx InitializeSecurityDescriptor CreateProcessWithTokenW SystemFunction036 RegQueryValueExW RegOpenKeyExW RegCloseKey

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits DeleteDC DeleteObject

kernel32

GetLastError FindClose AcquireSRWLockExclusive TerminateProcess WaitForSingleObject GetExitCodeProcess UnregisterWaitEx GetCurrentProcess OpenProcess VirtualAllocEx WriteProcessMemory CreateRemoteThread CloseHandle LocalAlloc CreateToolhelp32Snapshot Process32First Process32Next CreatePipe GetSystemDirectoryW ReadFile GetSystemInfo WakeAllConditionVariable ReleaseSRWLockExclusive LoadLibraryA GetProcAddress VirtualAlloc FreeLibrary GetModuleHandleA LoadLibraryW VirtualFree AddVectoredExceptionHandler SetThreadStackGuarantee HeapReAlloc WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex RtlLookupFunctionEntry GetCurrentThread RtlCaptureContext SwitchToThread SetLastError GetFinalPathNameByHandleW TryAcquireSRWLockExclusive GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes HeapAlloc GetProcessHeap HeapFree SetHandleInformation GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW Sleep QueryPerformanceFrequency GetModuleHandleW FormatMessageW GetEnvironmentVariableW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW SetFilePointerEx FindNextFileW FindFirstFileW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleFileNameW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentDirectoryW AcquireSRWLockShared ReleaseSRWLockShared SleepConditionVariableSRW WakeConditionVariable PostQueuedCompletionStatus SetConsoleCtrlHandler LocalFree lstrlenW RtlVirtualUnwind FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime WideCharToMultiByte SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact DeleteFileW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException EncodePointer RtlUnwindEx IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlPcToFileHeader

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

user32

SetProcessDPIAware GetDesktopWindow GetDC GetSystemMetrics ReleaseDC

crypt32

CertFreeCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CryptUnprotectData CertOpenStore CertDuplicateCertificateChain CertDuplicateStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertCloseStore

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

oleaut32

SafeArrayUnaccessData SafeArrayGetUBound SysStringLen GetErrorInfo SysFreeString SafeArrayGetLBound SafeArrayCreate SafeArrayCreateVector SafeArrayPutElement SafeArrayAccessData SysAllocStringLen

bcrypt

BCryptGenRandom

ws2_32

WSACleanup recv WSAIoctl getsockopt connect getaddrinfo freeaddrinfo setsockopt WSAGetLastError getpeername ioctlsocket WSASocketW WSASend shutdown send bind WSAStartup getsockname closesocket

ntdll

NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtReadFile

secur32

DeleteSecurityContext FreeCredentialsHandle InitializeSecurityContextW EncryptMessage FreeContextBuffer AcquireCredentialsHandleA DecryptMessage ApplyControlToken AcceptSecurityContext QueryContextAttributesW

api-ms-win-crt-string-l1-1-0

strncmp wcsncmp wcslen strcmp strcspn strlen strcpy_s

api-ms-win-crt-math-l1-1-0

log __setusermatherr _dclass roundf pow

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode realloc _msize malloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv __p___argc _exit exit _initterm_e _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _initialize_onexit_table _beginthreadex _register_onexit_function terminate _crt_atexit _c_exit abort _initterm _endthreadex

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_bfb9944f0c72ffe8867f40c42256a9b4_akira_cobalt-strike_glassworm_satacom_vidar

advapi32

gdi32

kernel32

ole32

shell32

user32

crypt32

userenv

oleaut32

bcrypt

ws2_32

ntdll

secur32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic