2026-07-12_fb61ebdfa8bcf15ea3cf0d3cefcf18ad_akira_cobalt-strike_glassworm

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_fb61ebdfa8bcf15ea3cf0d3cefcf18ad_akira_cobalt-strike_glassworm
Size 24.3MB
Sample260712-ms2hpsas31
SHA256 7bf4fa717bb1b536b7cb93c86bce62dfdae9a50bd66b3beeb977373c8ff3b312
MD5 fb61ebdfa8bcf15ea3cf0d3cefcf18ad
SHA1 ececf9adbf4c76d5ed92aae7cef963b605421f90
SHA512 00098375d341be62c4a685572b1160e1c3cf2caf0c4e24bd1000a36adca7efa854ffcd4f6ec17a4ce14e3df2d6160acc54d179cdd24324d3d5cdfc99b7021dfe
SSDEEP 98304:+Sm4sSf1UvDY3osgijHiRDuvS9zsJMSp61zgpcuzXScGPAPsgQ2bwxFNv8BoLlQJ:+tbLbsHiR7xUo0MTqiEoLSLd
TLSH
T1CD4752197B4F2CADD5AACC70868A46234E5434EB1836F97F84C546313BACBBD1F25B09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_fb61ebdfa8bcf15ea3cf0d3cefcf18ad_akira_cobalt-strike_glassworm

File Explorer

2026-07-12_fb61ebdfa8bcf15ea3cf0d3cefcf18ad_akira_cobalt-strike_glassworm

.exe 24.3MB

2026-07-12_fb61ebdfa8bcf15ea3cf0d3cefcf18ad_akira_cobalt-strike_glassworm

IMPHASH 84f02536b86084e835735c4a7d4325d8
SHA256 7bf4fa717bb1b536b7cb93c86bce62dfdae9a50bd66b3beeb977373c8ff3b312
MD5 fb61ebdfa8bcf15ea3cf0d3cefcf18ad
SHA1 ececf9adbf4c76d5ed92aae7cef963b605421f90
SHA512 00098375d341be62c4a685572b1160e1c3cf2caf0c4e24bd1000a36adca7efa854ffcd4f6ec17a4ce14e3df2d6160acc54d179cdd24324d3d5cdfc99b7021dfe
SSDEEP 98304:+Sm4sSf1UvDY3osgijHiRDuvS9zsJMSp61zgpcuzXScGPAPsgQ2bwxFNv8BoLlQJ:+tbLbsHiR7xUo0MTqiEoLSLd
TLSH
T1CD4752197B4F2CADD5AACC70868A46234E5434EB1836F97F84C546313BACBBD1F25B09
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19230688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

sqruff.pdb

kernel32

SetFileInformationByHandle CloseHandle GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo GetSystemInfo FindClose SetLastError GetConsoleOutputCP GetLastError WriteConsoleW GetFullPathNameW SetFileTime GetStdHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx ReadConsoleW GetFinalPathNameByHandleW GetFileType FindNextFileW GetSystemTimeAsFileTime GetModuleHandleExA FreeLibrary VirtualQuery VirtualFree VirtualAlloc GetCurrentProcessorNumber TlsFree TlsSetValue TlsAlloc GetProcessTimes ReleaseSRWLockExclusive WriteConsoleA WriteFile GetEnvironmentVariableA GetModuleFileNameW GetCommandLineW ExitProcess CreateFileW GetModuleHandleA CreateThread FormatMessageW GetModuleHandleW GetEnvironmentVariableW HeapFree InitializeSListHead SetUnhandledExceptionFilter InitializeSRWLock AcquireSRWLockExclusive WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer QueryPerformanceFrequency Sleep SwitchToThread GetCurrentThreadId RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetCurrentDirectoryW MultiByteToWideChar GetProcessHeap HeapReAlloc HeapAlloc

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueA

vcruntime140

__CxxFrameHandler3 memset memmove memcmp _CxxThrowException __C_specific_handler __std_terminate __current_exception __current_exception_context memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate exit _errno _set_app_type _exit _seh_filter_exe _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode __acrt_iob_func fputs _set_fmode

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_fb61ebdfa8bcf15ea3cf0d3cefcf18ad_akira_cobalt-strike_glassworm

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic