2026-07-10_f5da9e10bf86db600c38bac0d295465a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_f5da9e10bf86db600c38bac0d295465a_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 2.8MB
Sample260710-vlfawsfw41
SHA256 f64ea4c7952da431bdd25d5409fd45f8e1774a34251ac6028a6b134b5e351e21
MD5 f5da9e10bf86db600c38bac0d295465a
SHA1 2f4bc004d6923dc829370418c9be3dd9a4ff609e
SHA512 69b07539b93d8d2663c4e3c23e0c5907e68e187c7145e345845e906f9a3b04bc705c6a6aa6e27ca7f83b8e417e34848b272b67517e441c9bdf95e8e3933ee22a
SSDEEP 49152:7zkjbux+sc6uJ7V/ydT4vSuDWg8PPx4Q2LqlkRajYIU6i08t:v+BLj/yt0P8x3bjn+Pt
TLSH
T15FD56D03E69580E9C49DC078C35B9633AA73B88D0A3577EF2BE456112F2AF906F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_f5da9e10bf86db600c38bac0d295465a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-10_f5da9e10bf86db600c38bac0d295465a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 2.8MB

2026-07-10_f5da9e10bf86db600c38bac0d295465a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 05ad75bfe2cbd2c9e9e72f929708a99a
SHA256 f64ea4c7952da431bdd25d5409fd45f8e1774a34251ac6028a6b134b5e351e21
MD5 f5da9e10bf86db600c38bac0d295465a
SHA1 2f4bc004d6923dc829370418c9be3dd9a4ff609e
SHA512 69b07539b93d8d2663c4e3c23e0c5907e68e187c7145e345845e906f9a3b04bc705c6a6aa6e27ca7f83b8e417e34848b272b67517e441c9bdf95e8e3933ee22a
SSDEEP 49152:7zkjbux+sc6uJ7V/ydT4vSuDWg8PPx4Q2LqlkRajYIU6i08t:v+BLj/yt0P8x3bjn+Pt
TLSH
T15FD56D03E69580E9C49DC078C35B9633AA73B88D0A3577EF2BE456112F2AF906F1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1968672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mda.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CopyFileExW GetFileType WaitForMultipleObjects GetSystemDirectoryW FindNextFileW ExitProcess CreateDirectoryW ReadConsoleW CreateIoCompletionPort SetFileCompletionNotificationModes FindFirstFileExW SetFileTime CancelIo SetLastError GetFullPathNameW CreateEventW DeleteFileW ReadFile PostQueuedCompletionStatus WriteFile GetOverlappedResult Sleep SetWaitableTimer CreateWaitableTimerExW DeviceIoControl CancelIoEx SleepEx WriteFileEx GetSystemTimeAsFileTime CreateThread SetHandleInformation ReadFileEx SwitchToThread GetNumberOfConsoleInputEvents ReadConsoleInputW GetConsoleCursorInfo SetConsoleCursorInfo SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetStdHandle GetFileInformationByHandleEx GetConsoleScreenBufferInfo CreateFileW SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetCurrentThread SetThreadStackGuarantee GetExitCodeProcess WaitForSingleObject CloseHandle SetFileInformationByHandle GetLastError GetFinalPathNameByHandleW WriteConsoleW GetSystemTimePreciseAsFileTime GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx GetCurrentThreadId GetQueuedCompletionStatusEx GetFileInformationByHandle FindClose InitializeSListHead GetCommandLineW CompareStringOrdinal AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA QueryPerformanceCounter FormatMessageW GetModuleHandleW QueryPerformanceFrequency GetEnvironmentVariableW HeapAlloc MultiByteToWideChar WideCharToMultiByte lstrlenW GetProcAddress LoadLibraryA SetUnhandledExceptionFilter

ws2_32

getsockname WSAGetLastError getpeername WSAIoctl WSASend shutdown send getaddrinfo WSACleanup WSAStartup bind setsockopt getsockopt connect ioctlsocket WSASocketW closesocket recv freeaddrinfo

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtOpenFile NtCreateNamedPipeFile NtReadFile NtCreateFile NtWriteFile

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

memset memcpy memmove __CxxFrameHandler3 memcmp __current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-math-l1-1-0

trunc pow round __setusermatherr ceil fma fmod truncf

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment __p___argc _exit _set_app_type _seh_filter_exe _initterm _initialize_onexit_table _register_onexit_function _initterm_e exit _cexit _register_thread_local_exe_atexit_callback terminate _configure_narrow_argv __p___argv _c_exit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_f5da9e10bf86db600c38bac0d295465a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

ws2_32

ntdll

bcryptprimitives

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic