2026-07-18_6840d9ed312368ab8fc02fc0f8b64f45_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_6840d9ed312368ab8fc02fc0f8b64f45_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.4MB
Sample260718-m9vrgscx21
SHA256 4c208b2dd3975d96bbaae431c97f43a6b6f8fb078ec1d0205f64d794b9d89932
MD5 6840d9ed312368ab8fc02fc0f8b64f45
SHA1 3d65b21a04c05ad4d56167ecd866f0db8feb79f0
SHA512 cab92ffbe9b7fa6a29eb8963be604502de5da183bcfb49400087377cc2c0b8b57fe6e14c47a3cd82bf712b71335b21e0a49a9041da95427ea5c283bc228b9866
SSDEEP 49152:b/0yUKixQ2cws5EcC2PN1r2rC7JvPE02UgJV/c1QSjVyDpSKJuK8J0yHn9rVykUE:An871qmtnE/9JCQSUlNurV0hn+
TLSH
T123F55A43F66690E9C16AC078834AA632FA327C8D073176EB57D49B353E61FD06A3DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_6840d9ed312368ab8fc02fc0f8b64f45_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-18_6840d9ed312368ab8fc02fc0f8b64f45_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.4MB

2026-07-18_6840d9ed312368ab8fc02fc0f8b64f45_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH b53d561e89ab7857172f6f049dbee585
SHA256 4c208b2dd3975d96bbaae431c97f43a6b6f8fb078ec1d0205f64d794b9d89932
MD5 6840d9ed312368ab8fc02fc0f8b64f45
SHA1 3d65b21a04c05ad4d56167ecd866f0db8feb79f0
SHA512 cab92ffbe9b7fa6a29eb8963be604502de5da183bcfb49400087377cc2c0b8b57fe6e14c47a3cd82bf712b71335b21e0a49a9041da95427ea5c283bc228b9866
SSDEEP 49152:b/0yUKixQ2cws5EcC2PN1r2rC7JvPE02UgJV/c1QSjVyDpSKJuK8J0yHn9rVykUE:An871qmtnE/9JCQSUlNurV0hn+
TLSH
T123F55A43F66690E9C16AC078834AA632FA327C8D073176EB57D49B353E61FD06A3DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2559456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ciris_build_sign.pdb

kernel32

GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess GetFileType WideCharToMultiByte GetProcessHeap CreateMutexA FindNextFileW GetCurrentProcessId lstrlenW GetCurrentProcess SetFileInformationByHandle WaitForSingleObjectEx GetCurrentThreadId WaitForSingleObject GetModuleFileNameW CreateThread CreateFileW CancelIoEx SetFileTime GetFinalPathNameByHandleW SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetFullPathNameW SetHandleInformation GetQueuedCompletionStatusEx SwitchToThread ReleaseMutex FindClose GetConsoleOutputCP FindFirstFileExW SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetStdHandle GetCurrentThread SetThreadStackGuarantee SetLastError GetProcAddress GetModuleHandleA Sleep WriteFile MultiByteToWideChar FormatMessageW GetLastError HeapAlloc CloseHandle HeapFree WriteConsoleW SetUnhandledExceptionFilter HeapReAlloc GetCommandLineW AddVectoredExceptionHandler InitializeSListHead GetSystemTimePreciseAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter GetSystemInfo GetSystemTimeAsFileTime

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSACleanup WSAStartup freeaddrinfo recv connect bind WSAIoctl ioctlsocket WSASocketW setsockopt closesocket send shutdown WSASend getsockopt getsockname WSAGetLastError getpeername getaddrinfo

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtReadFile NtWriteFile NtDeviceIoControlFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

memcmp memcpy __current_exception_context __current_exception memmove __CxxFrameHandler3 memset __C_specific_handler

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _register_onexit_function _set_app_type _get_initial_narrow_environment _initterm exit _exit _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_onexit_table _initialize_narrow_environment _initterm_e

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_6840d9ed312368ab8fc02fc0f8b64f45_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic