2026-07-06_86d23ff2bb85d507abca2bcc1916832c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_86d23ff2bb85d507abca2bcc1916832c_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.3MB
Sample260707-c1ghdsf18x
SHA256 427d45e54c7c8b3bca88e5367bc1e5d0cbd529f10ce93e051beb777bd29484b9
MD5 86d23ff2bb85d507abca2bcc1916832c
SHA1 502023a7d29f21abe6493d2634496cc465e0467d
SHA512 5e3a916a1675757869b2d470f436d73fc98a5a48bddfe9fb1a67f0cde1b5c6577f04ae5eb524b5ba85267a8bbcb9c8d7f8372aeebda2157e48acec585c14761d
SSDEEP 49152:CtsLY0zQLgqSSJiYAJi9SPU13AkM1g1llCUZjguyeivCAtYLvS99LYIU6ip:esOz6i9S7kM1YlT26pTMLn+
TLSH
T10FF55A43F66690E9C569C078834AA632FA327C8D073176EB5BE44B313E65FD06A3DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_86d23ff2bb85d507abca2bcc1916832c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-06_86d23ff2bb85d507abca2bcc1916832c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.3MB

2026-07-06_86d23ff2bb85d507abca2bcc1916832c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 4cf8e33cdb7f7b487b16176a1e20a7ea
SHA256 427d45e54c7c8b3bca88e5367bc1e5d0cbd529f10ce93e051beb777bd29484b9
MD5 86d23ff2bb85d507abca2bcc1916832c
SHA1 502023a7d29f21abe6493d2634496cc465e0467d
SHA512 5e3a916a1675757869b2d470f436d73fc98a5a48bddfe9fb1a67f0cde1b5c6577f04ae5eb524b5ba85267a8bbcb9c8d7f8372aeebda2157e48acec585c14761d
SSDEEP 49152:CtsLY0zQLgqSSJiYAJi9SPU13AkM1g1llCUZjguyeivCAtYLvS99LYIU6ip:esOz6i9S7kM1YlT26pTMLn+
TLSH
T10FF55A43F66690E9C569C078834AA632FA327C8D073176EB5BE44B313E65FD06A3DB05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2549088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ciris_build_sign.pdb

kernel32

GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess GetFileType WideCharToMultiByte GetProcessHeap CreateMutexA FindNextFileW GetCurrentProcessId lstrlenW GetCurrentProcess SetFileTime WaitForSingleObjectEx GetCurrentThreadId CreateThread GetModuleFileNameW WaitForSingleObject CreateFileW CancelIoEx GetFullPathNameW SetFileCompletionNotificationModes CreateIoCompletionPort MultiByteToWideChar GetQueuedCompletionStatusEx SetHandleInformation ReadFile WriteFile PostQueuedCompletionStatus GetOverlappedResult SwitchToThread ReleaseMutex FindClose GetConsoleOutputCP FindFirstFileExW GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle GetCurrentThread SetThreadStackGuarantee SetLastError GetProcAddress GetModuleHandleA Sleep SetFileInformationByHandle GetFinalPathNameByHandleW FormatMessageW GetLastError HeapAlloc CloseHandle HeapFree WriteConsoleW SetUnhandledExceptionFilter GetCommandLineW HeapReAlloc GetEnvironmentVariableW InitializeSListHead AddVectoredExceptionHandler GetSystemTimePreciseAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter GetCurrentDirectoryW GetSystemInfo GetSystemTimeAsFileTime LoadLibraryA

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSACleanup WSAStartup freeaddrinfo recv connect bind WSAIoctl ioctlsocket WSASocketW setsockopt closesocket send shutdown WSASend getsockopt getsockname WSAGetLastError getpeername getaddrinfo

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtReadFile NtWriteFile NtCancelIoFileEx

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

memmove memcpy __current_exception_context __current_exception memset __CxxFrameHandler3 __C_specific_handler memcmp

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _register_onexit_function _set_app_type _initialize_narrow_environment _initterm exit _exit _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _configure_narrow_argv _initialize_onexit_table _initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_86d23ff2bb85d507abca2bcc1916832c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic