2026-07-15_e1a2e94fc1cd538bfc59863a06ca198a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_e1a2e94fc1cd538bfc59863a06ca198a_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 827KB
Sample260715-jbbzyaev2m
SHA256 105b91c5ab319c97268e1d50c15dbbdeb31b58d47a3a80fddfb5e39fe5dded08
MD5 e1a2e94fc1cd538bfc59863a06ca198a
SHA1 a91cf3da256922809ecbbc2b8509bdce1d22c287
SHA512 8fec21918b229ba4dac462f067e3b94dd7cc661083b13510ae81c203a2f67dc8eeae899a879a3a844eb8b34295af0a31aa0459d8468037146a1b71c708b1481a
SSDEEP 12288:fVJ/Uz9RIjY7CT3efZk6T301dz/dIlZEtD:fVJ/UzCY7CT3efZk6D0OfY
TLSH
T1EF053A47F65290E8C06AC0B5935A6533BA32BC4D07357AFB16A46A313E71FE06B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_e1a2e94fc1cd538bfc59863a06ca198a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-15_e1a2e94fc1cd538bfc59863a06ca198a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 827KB

2026-07-15_e1a2e94fc1cd538bfc59863a06ca198a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH c4a9bae6a8b1f145a35c8cf65fb50464
SHA256 105b91c5ab319c97268e1d50c15dbbdeb31b58d47a3a80fddfb5e39fe5dded08
MD5 e1a2e94fc1cd538bfc59863a06ca198a
SHA1 a91cf3da256922809ecbbc2b8509bdce1d22c287
SHA512 8fec21918b229ba4dac462f067e3b94dd7cc661083b13510ae81c203a2f67dc8eeae899a879a3a844eb8b34295af0a31aa0459d8468037146a1b71c708b1481a
SSDEEP 12288:fVJ/Uz9RIjY7CT3efZk6T301dz/dIlZEtD:fVJ/UzCY7CT3efZk6D0OfY
TLSH
T1EF053A47F65290E8C06AC0B5935A6533BA32BC4D07357AFB16A46A313E71FE06B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

649712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ciris_build_verify.pdb

kernel32

CreateMutexA GetCurrentProcessId lstrlenW GetConsoleOutputCP WaitForSingleObjectEx WideCharToMultiByte GetConsoleMode HeapFree HeapAlloc WaitForSingleObject GetLastError FormatMessageW GetCurrentThreadId ReleaseMutex GetProcAddress GetModuleHandleA SetLastError CloseHandle SetThreadStackGuarantee GetCurrentThread GetStdHandle GetModuleFileNameW SetConsoleTextAttribute GetConsoleScreenBufferInfo MultiByteToWideChar WriteConsoleW SwitchToThread GetFileInformationByHandle CreateFileW GetFullPathNameW GetFileInformationByHandleEx SetConsoleMode GetFileType GetCurrentProcess ExitProcess GetProcessHeap GetCurrentDirectoryW InitializeSListHead GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleW GetEnvironmentVariableW LoadLibraryA SetUnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext AddVectoredExceptionHandler HeapReAlloc GetCommandLineW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

vcruntime140

memcpy memcmp memmove __CxxFrameHandler3 memset __current_exception_context __current_exception __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _set_app_type _register_onexit_function _initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_e1a2e94fc1cd538bfc59863a06ca198a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic