2026-07-08_4256e606e7ce4b95ee596a41bf0fb5d1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_4256e606e7ce4b95ee596a41bf0fb5d1_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 9.9MB
Sample260708-gzcv2abz21
SHA256 5f88adf66cef32bc44ee9fbfcc3b6312ded34f63bd7db45c56dd125cd9ae395f
MD5 4256e606e7ce4b95ee596a41bf0fb5d1
SHA1 c9ac6652c74165b6041aca683f23dbebdb2a2aac
SHA512 3f964860667d727589aaabf124fa06dcd56dd73a620a5efe406de6ea004a258b0f9a4d6725ba49be0de62bf6629cc780b42542bf7dafda5b6bea45b1755668b2
SSDEEP 98304:oKSUu+M4LnT/xTHM6qu6jFqF2a2xDBPk0ibIFPz0rKVH1s:nABqFo9iEFrIKTs
TLSH
T1BEA65B116A9B98ADD19AC870C3468A735E2130DB1B36B9FF44C495393FADBF41F39218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_4256e606e7ce4b95ee596a41bf0fb5d1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-08_4256e606e7ce4b95ee596a41bf0fb5d1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 9.9MB

2026-07-08_4256e606e7ce4b95ee596a41bf0fb5d1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d2de53e8abc8c63740b65e1071b47b76
SHA256 5f88adf66cef32bc44ee9fbfcc3b6312ded34f63bd7db45c56dd125cd9ae395f
MD5 4256e606e7ce4b95ee596a41bf0fb5d1
SHA1 c9ac6652c74165b6041aca683f23dbebdb2a2aac
SHA512 3f964860667d727589aaabf124fa06dcd56dd73a620a5efe406de6ea004a258b0f9a4d6725ba49be0de62bf6629cc780b42542bf7dafda5b6bea45b1755668b2
SSDEEP 98304:oKSUu+M4LnT/xTHM6qu6jFqF2a2xDBPk0ibIFPz0rKVH1s:nABqFo9iEFrIKTs
TLSH
T1BEA65B116A9B98ADD19AC870C3468A735E2130DB1B36B9FF44C495393FADBF41F39218
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5305888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sololauncher.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetProcAddress GetModuleHandleA RtlUnwindEx GetCurrentThreadId RtlPcToFileHeader GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort RaiseException GetQueuedCompletionStatusEx FlsAlloc FlsGetValue TerminateProcess FlsSetValue FlsFree GetProcessId InitializeSListHead GetModuleHandleW GetSystemTimeAsFileTime EncodePointer CloseHandle WaitForSingleObject GetSystemInfo lstrlenW SleepConditionVariableSRW WakeAllConditionVariable CreateThread SetUnhandledExceptionFilter AcquireSRWLockExclusive ReleaseSRWLockExclusive Sleep GetCurrentThread GlobalUnlock LoadLibraryExW GetLastError InitializeCriticalSectionEx HeapReAlloc HeapFree ReleaseMutex AddVectoredExceptionHandler SetThreadStackGuarantee FindFirstFileExW FindClose OutputDebugStringW QueryPerformanceCounter OutputDebugStringA LCIDToLocaleName GetUserDefaultUILanguage LoadLibraryExA FreeLibrary SetFilePointerEx CreateWaitableTimerExW LoadLibraryW SetWaitableTimer GetProcessHeap PostQueuedCompletionStatus QueryPerformanceFrequency K32GetPerformanceInfo GlobalMemoryStatusEx GetUserPreferredUILanguages GetNativeSystemInfo LocalFree VirtualQueryEx GlobalLock GlobalSize MultiByteToWideChar GlobalAlloc ReadProcessMemory SwitchToThread GlobalFree GetSystemTimePreciseAsFileTime GetCurrentProcessId GetExitCodeProcess CreateMutexW GetProcessIoCounters CreatePipe WaitForMultipleObjects GetOverlappedResult GetSystemTimes GetProcessTimes FindNextFileW GetTempPathW SetEnvironmentVariableW DeleteFileW GetFileInformationByHandleEx RemoveDirectoryW MoveFileExW SetFileInformationByHandle GetCommandLineW CopyFileExW CreateToolhelp32Snapshot Thread32First ResumeThread Thread32Next OpenThread SuspendThread OpenProcess VirtualAllocEx WriteProcessMemory CreateRemoteThread VirtualFreeEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess CreateMutexA WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP DuplicateHandle WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx FormatMessageW GetModuleFileNameW GetFileAttributesW SetHandleInformation GetFullPathNameW CreateFileW SetFileTime GetFileInformationByHandle CreateProcessW CreateDirectoryW ExitProcess CreateEventW CancelIo ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW DeleteCriticalSection

user32

GetAncestor AdjustWindowRectEx SystemParametersInfoA CloseClipboard GetUpdateRect CreateMenu AppendMenuW CreateIcon UnregisterHotKey RegisterHotKey GetKeyboardLayout DestroyIcon PeekMessageW GetMessageA DispatchMessageA SetWindowLongW GetSystemMenu ShowWindow ShowCursor PostThreadMessageW ValidateRect ClipCursor GetRawInputData RegisterRawInputDevices EnumChildWindows GetMessageW SetWindowLongPtrW GetClipCursor GetMonitorInfoW SetMenuItemInfoW CloseTouchInputHandle GetTouchInputInfo DestroyWindow TranslateAcceleratorW IsProcessDPIAware TrackMouseEvent ToUnicodeEx GetDC PostQuitMessage CreateAcceleratorTableW SetCapture RegisterWindowMessageA SetWindowTextW GetWindowPlacement GetWindowTextW GetWindowLongW ScreenToClient VkKeyScanW MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState TranslateMessage DispatchMessageW ChangeDisplaySettingsExW SetWindowPlacement RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW RegisterClassExW ReleaseCapture GetCursorPos SetCursorPos SetCursor LoadCursorW SendMessageW SendInput MapVirtualKeyW SetForegroundWindow GetForegroundWindow InvalidateRgn SetWindowPos GetClientRect PostMessageW ClientToScreen EnumDisplayMonitors MonitorFromPoint IsIconic IsWindowVisible GetWindowRect MonitorFromWindow GetMenu GetWindowLongPtrW SetWindowDisplayAffinity GetActiveWindow SetMenu CheckMenuItem EnableMenuItem RedrawWindow FlashWindowEx IsClipboardFormatAvailable GetWindowTextLengthW MonitorFromRect GetClipboardData EmptyClipboard SetClipboardData MsgWaitForMultipleObjectsEx FindWindowW DestroyAcceleratorTable OpenClipboard DefWindowProcW

advapi32

OpenProcessToken GetTokenInformation RegQueryValueExW RegOpenKeyExW IsValidSid GetLengthSid CopySid EventRegister EventSetInformation EventWriteTransfer EventUnregister RegGetValueW RegCloseKey ImpersonateAnonymousToken RevertToSelf SystemFunction036

shell32

CommandLineToArgvW ShellExecuteW SHCreateItemFromParsingName DragQueryFileW DragFinish SHAppBarMessage SHGetKnownFolderPath

ole32

OleInitialize CoUninitialize CoInitializeEx CreateStreamOnHGlobal RevokeDragDrop CoTaskMemAlloc CoTaskMemFree RegisterDragDrop CoCreateInstance CoIncrementMTAUsage

ws2_32

WSASocketW setsockopt bind connect ioctlsocket WSAIoctl getsockopt freeaddrinfo getaddrinfo closesocket WSAStartup WSACleanup getsockname WSAGetLastError getpeername send recv shutdown WSASend

ntdll

RtlNtStatusToDosError NtWriteFile NtOpenFile NtDeviceIoControlFile NtCreateFile RtlGetVersion NtCreateNamedPipeFile NtReadFile NtCancelIoFileEx NtQueryInformationProcess NtQuerySystemInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

bcrypt

BCryptGenRandom

crypt32

CertEnumCertificatesInStore CertGetCertificateChain CertOpenStore CertFreeCertificateChain CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertDuplicateStore CertDuplicateCertificateContext CertCloseStore

secur32

AcquireCredentialsHandleA FreeContextBuffer QueryContextAttributesW ApplyControlToken EncryptMessage InitializeSecurityContextW AcceptSecurityContext DecryptMessage FreeCredentialsHandle DeleteSecurityContext

gdi32

GetDeviceCaps DeleteObject CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

pdh

PdhEnumObjectsA PdhAddEnglishCounterW PdhOpenQueryA PdhCloseQuery PdhCollectQueryData PdhRemoveCounter PdhGetFormattedCounterValue

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

uxtheme

SetWindowTheme

api-ms-win-crt-math-l1-1-0

round floor trunc pow __setusermatherr

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strcpy_s strlen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _seh_filter_exe _register_thread_local_exe_atexit_callback _exit _set_app_type exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm_e _initterm abort _get_initial_narrow_environment _configure_narrow_argv _initialize_narrow_environment _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc calloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_4256e606e7ce4b95ee596a41bf0fb5d1_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

advapi32

shell32

ole32

ws2_32

ntdll

api-ms-win-core-winrt-l1-1-0

oleaut32

bcrypt

crypt32

secur32

gdi32

dwmapi

comctl32

version

pdh

psapi

powrprof

uxtheme

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic