2026-07-09_cf3dd0036b0a12b3672774bf84441501_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_cf3dd0036b0a12b3672774bf84441501_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 11.8MB
Sample260709-jtr4waft2w
SHA256 5bee3c2df6e15f734e13a37dfde7973f3d6dfb44fbeeca4d0b7027b24d3ab3bf
MD5 cf3dd0036b0a12b3672774bf84441501
SHA1 f18d2e27aae0d0640745b47508fc8ea7ac150f62
SHA512 e79c3d8a323403e1c6ee035ab1b22349d69b9904b9cf1bd23f98c426ec4084d620ec5a9e9ee001b53385c1f2721d90d68a49d53c410e6e1b14a13e6cfb75c762
SSDEEP 98304:gfIxu/ITDgrrAzqIPx/9wwlJ1365v6l5DxQIsP/gVbPlOjgMC+UwPUV0gsI27:TJprlbYjkQ7
TLSH
T136C617117A5F98ACC59AC870834A4A731E2134DB1B36B9FF44C456393F6EBB42B39718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_cf3dd0036b0a12b3672774bf84441501_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-09_cf3dd0036b0a12b3672774bf84441501_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 11.8MB

2026-07-09_cf3dd0036b0a12b3672774bf84441501_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 30c9b0b8f418c192bdf05d06d8677f08
SHA256 5bee3c2df6e15f734e13a37dfde7973f3d6dfb44fbeeca4d0b7027b24d3ab3bf
MD5 cf3dd0036b0a12b3672774bf84441501
SHA1 f18d2e27aae0d0640745b47508fc8ea7ac150f62
SHA512 e79c3d8a323403e1c6ee035ab1b22349d69b9904b9cf1bd23f98c426ec4084d620ec5a9e9ee001b53385c1f2721d90d68a49d53c410e6e1b14a13e6cfb75c762
SSDEEP 98304:gfIxu/ITDgrrAzqIPx/9wwlJ1365v6l5DxQIsP/gVbPlOjgMC+UwPUV0gsI27:TJprlbYjkQ7
TLSH
T136C617117A5F98ACC59AC870834A4A731E2134DB1B36B9FF44C456393F6EBB42B39718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8448784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zccache.pdb

kernel32

WriteFileEx FlushFileBuffers SetNamedPipeHandleState WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetFileTime WaitForSingleObject SetThreadStackGuarantee GetCurrentThread SetLastError GetSystemTimePreciseAsFileTime SetFileAttributesW CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW CreateSymbolicLinkW GetFileInformationByHandleEx DuplicateHandle GetFileInformationByHandle DeleteFileW CreateThread DeviceIoControl CreateHardLinkW GetFileType GetModuleHandleW LockFile SetFileInformationByHandle UnmapViewOfFile GetFullPathNameW GetTempPathW ExitProcess CreateFileMappingW GetModuleHandleA CancelIoEx HeapAlloc ReadConsoleW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateEventW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW TerminateProcess WaitForMultipleObjects FindNextFileW CancelIo OpenProcess QueryFullProcessImageNameW CreateFileW MapViewOfFile FindFirstFileExW GetCurrentProcess SleepEx DeleteProcThreadAttributeList SetFileCompletionNotificationModes WaitNamedPipeW ReadFileEx CreateProcessW CreateIoCompletionPort UpdateProcThreadAttribute SwitchToThread FindClose InitializeProcThreadAttributeList LockFileEx lstrlenW LocalFree GetSystemTimeAsFileTime Sleep GetSystemInfo GetCurrentThreadId GetCurrentProcessId SetFilePointerEx CloseHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetQueuedCompletionStatusEx GetConsoleMode GetStdHandle HeapFree HeapReAlloc GetProcessHeap VirtualProtect UnlockFile GetModuleFileNameW LoadLibraryExW SetThreadErrorMode FreeLibrary GetExitCodeProcess WriteFile ReadFile PostQueuedCompletionStatus GetProcAddress GetOverlappedResult SetHandleInformation WideCharToMultiByte GetLastError InitializeSListHead SetUnhandledExceptionFilter RtlCaptureContext QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW RtlVirtualUnwind RtlLookupFunctionEntry FormatMessageW SetEnvironmentVariableW SetCurrentDirectoryW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

bcrypt

BCryptGenRandom

advapi32

GetSecurityDescriptorDacl GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction036 IsValidSid SetNamedSecurityInfoW GetLengthSid GetNamedSecurityInfoW ConvertSecurityDescriptorToStringSecurityDescriptorW OpenProcessToken

ws2_32

send WSASend getpeername WSAStartup WSACleanup connect getsockname getaddrinfo WSAIoctl shutdown WSAGetLastError getsockopt closesocket setsockopt bind ioctlsocket WSASocketW freeaddrinfo recv

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile NtCreateNamedPipeFile NtReadFile NtOpenFile

crypt32

CertDuplicateCertificateContext CertGetEnhancedKeyUsage CertOpenStore CertCloseStore CertFreeCertificateContext CertEnumCertificatesInStore CertVerifyTimeValidity

vcruntime140

__current_exception memcpy __CxxFrameHandler3 memmove memset memcmp __current_exception_context _CxxThrowException __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _crt_atexit _register_onexit_function _configure_narrow_argv _initialize_onexit_table terminate _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc _set_app_type __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_cf3dd0036b0a12b3672774bf84441501_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

shell32

combase

bcrypt

advapi32

ws2_32

ntdll

crypt32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic