2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 17.3MB
Sample260707-fdt2rah131
SHA256 e1c01e0d170445a1ab1051c8531a675eff3a9a57db7529d190a01e043dcb3724
MD5 286546739e6df7bdc10ca44cb3437141
SHA1 4b39117bb739e990bc0d18de88896067170548ce
SHA512 59cdb97d5a3a38710db2be5f5fb19418caba6faa59a02c640bc811a1086f5bc3f5b8dacd974f33df95f5aa9b388f28e4a5f0a1dbce9cee21ab09819d90dee7d3
SSDEEP 98304:qmvucxrjfEtUh1peWkagUqRIUqI5wZNRm+yfj5W1cHo1O:qyDxrx1SGUfwZyhfj57
TLSH
T14B070A26F9494D65D199C434829A4753063070CB1E14BDBF36CC892C2F9FFBE6A3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 17.3MB

2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 9ca1cf750119c02732f2e98f757827d0
SHA256 e1c01e0d170445a1ab1051c8531a675eff3a9a57db7529d190a01e043dcb3724
MD5 286546739e6df7bdc10ca44cb3437141
SHA1 4b39117bb739e990bc0d18de88896067170548ce
SHA512 59cdb97d5a3a38710db2be5f5fb19418caba6faa59a02c640bc811a1086f5bc3f5b8dacd974f33df95f5aa9b388f28e4a5f0a1dbce9cee21ab09819d90dee7d3
SSDEEP 98304:qmvucxrjfEtUh1peWkagUqRIUqI5wZNRm+yfj5W1cHo1O:qyDxrx1SGUfwZyhfj57
TLSH
T14B070A26F9494D65D199C434829A4753063070CB1E14BDBF36CC892C2F9FFBE6A3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

27:85:e2:aa:50:3c:24:2c:d4:e9:10:b5:b1:c5:f7:68:c3:12:05:a5:1b:bf:19:37:6e:fd:f0:63:82:1a:38:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Jul 5, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

7a:08:df:7f:49:7c:5f:19:8d:3e:e0:ab

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 8, 2026 - Aug 10, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

8600736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

llmfit.pdb

kernel32

GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCtrlHandler WideCharToMultiByte CreateEventW lstrlenW GetExitCodeProcess GetConsoleMode GetSystemInfo LocalFree K32GetPerformanceInfo GlobalMemoryStatusEx GetCurrentProcessId RtlVirtualUnwind CreateConsoleScreenBuffer MultiByteToWideChar SetFileCompletionNotificationModes GetProcessHeap HeapFree ReadFile GetOverlappedResult GetQueuedCompletionStatusEx CreateIoCompletionPort PostQueuedCompletionStatus SetConsoleActiveScreenBuffer SetConsoleCursorPosition OpenProcess SetConsoleCursorInfo GetProcessTimes SetConsoleTextAttribute VirtualQueryEx GetConsoleScreenBufferInfo SetHandleInformation GetSystemTimes ReadProcessMemory SetConsoleMode HeapAlloc GetProcessIoCounters WriteConsoleW CreateFileW WaitForMultipleObjects FormatMessageW Process32NextW Process32FirstW GetCurrentThread GlobalFree GetSystemTimeAsFileTime GlobalUnlock CreateToolhelp32Snapshot GetFinalPathNameByHandleW SetLastError GlobalAlloc GlobalLock GetStdHandle InitializeSListHead GetBinaryTypeW SetUnhandledExceptionFilter GetProcAddress GetModuleHandleA Sleep GetLastError CloseHandle CompareStringOrdinal FindNextFileW GetModuleHandleW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP ReadConsoleW GetModuleFileNameW DeleteFileW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx SwitchToThread ExitProcess FindClose FindFirstFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW TerminateProcess GetProcessId CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess ReadFileEx CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW GetCurrentThreadId GetFullPathNameW SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW

ws2_32

WSACleanup freeaddrinfo WSAStartup socket WSAGetLastError select shutdown listen bind WSASocketW connect ioctlsocket setsockopt accept getsockopt getpeername send WSASend recv WSAIoctl closesocket getaddrinfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shell32

CommandLineToArgvW SHGetKnownFolderPath

advapi32

GetTokenInformation ImpersonateAnonymousToken RevertToSelf SystemFunction036 CopySid GetLengthSid IsValidSid OpenProcessToken

ntdll

NtDeviceIoControlFile NtCreateFile NtQueryInformationProcess RtlGetVersion NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtOpenFile NtWriteFile NtReadFile

combase

CoTaskMemFree

pdh

PdhOpenQueryW PdhAddEnglishCounterW PdhRemoveCounter PdhGetFormattedCounterValue PdhEnumObjectsW PdhCollectQueryData PdhCloseQuery

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo

psapi

GetProcessMemoryInfo GetModuleFileNameExW

bcryptprimitives

ProcessPrng

user32

RegisterClipboardFormatW CloseClipboard GetForegroundWindow GetWindowThreadProcessId GetKeyboardLayout ToUnicodeEx SetClipboardData EmptyClipboard OpenClipboard

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcpy memcmp memmove memset _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

trunc __setusermatherr exp pow ceil round

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback __p___argc strerror _exit exit _c_exit _cexit terminate _initterm_e _initterm _get_initial_narrow_environment _seh_filter_exe _initialize_onexit_table _initialize_narrow_environment _register_onexit_function _configure_narrow_argv _set_app_type _crt_atexit __p___argv

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_286546739e6df7bdc10ca44cb3437141_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

shell32

advapi32

ntdll

combase

pdh

powrprof

oleaut32

psapi

bcryptprimitives

user32

bcrypt

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic