2026-07-18_c9d63088b5bde4dd67ba6b344b828967_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_c9d63088b5bde4dd67ba6b344b828967_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 85.3MB
Sample260718-mes96sbv9v
SHA256 3e0ae3e42dc5fa2d5eda6c5c8579d1d4d3757c6ef8598195a302ce0e6a9dcee2
MD5 c9d63088b5bde4dd67ba6b344b828967
SHA1 18f417c5ad10411665e953d2884197fb4dfc3449
SHA512 7fea89d8f8ea6245cb7121baadcc1d044097926ee3f51f35e92d0e0b2ac0cd49b4fb71f6b4389975f1e137622a330115ba212f71cf25a533ef2521a1b7ddfb0b
SSDEEP 1572864:gekdvEDBGCj8qeuxIttD4dw+EyIUeSLAsoFGh29CelVJKlk54yawrt:geko0erec6tYwByIY3oFGH44J
TLSH
T16A182201BA5A9564D05AC878D2474A934F3270EE063BA4FF51E941243FAB7F09B3E35B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_c9d63088b5bde4dd67ba6b344b828967_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-18_c9d63088b5bde4dd67ba6b344b828967_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 85.3MB

2026-07-18_c9d63088b5bde4dd67ba6b344b828967_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 093a6cd038fd14a54e7d359b46cb8dab
SHA256 3e0ae3e42dc5fa2d5eda6c5c8579d1d4d3757c6ef8598195a302ce0e6a9dcee2
MD5 c9d63088b5bde4dd67ba6b344b828967
SHA1 18f417c5ad10411665e953d2884197fb4dfc3449
SHA512 7fea89d8f8ea6245cb7121baadcc1d044097926ee3f51f35e92d0e0b2ac0cd49b4fb71f6b4389975f1e137622a330115ba212f71cf25a533ef2521a1b7ddfb0b
SSDEEP 1572864:gekdvEDBGCj8qeuxIttD4dw+EyIUeSLAsoFGh29CelVJKlk54yawrt:geko0erec6tYwByIY3oFGH44J
TLSH
T16A182201BA5A9564D05AC878D2474A934F3270EE063BA4FF51E941243FAB7F09B3E35B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6120512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Updater.pdb

kernel32

SetFileTime GetModuleHandleW VirtualProtect LoadLibraryExA FormatMessageW GetDiskFreeSpaceExW GetLastError GetTickCount64 GetConsoleWindow LoadLibraryA HeapAlloc HeapFree GetProcessHeap FreeConsole GetConsoleMode GetConsoleOutputCP Sleep DeleteFileW SetLastError WriteConsoleW GetModuleFileNameW LoadLibraryExW GetProcAddress CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW HeapReAlloc GetSystemTimePreciseAsFileTime GetTempPathW FindClose GlobalLock SetHandleInformation SetFileInformationByHandle GetFileInformationByHandleEx GetPhysicallyInstalledSystemMemory SetFileCompletionNotificationModes GlobalUnlock GetFileInformationByHandle GetModuleHandleA WriteFileEx ReadFileEx CreateFileMappingW MapViewOfFile CancelIo GetSystemInfo GetOverlappedResult GetStdHandle ReadFile GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW SetFilePointerEx CreateIoCompletionPort FindNextFileW PostQueuedCompletionStatus GlobalSize GlobalAlloc GlobalFree GetSystemTimeAsFileTime FreeLibrary GetQueuedCompletionStatusEx DuplicateHandle SetThreadErrorMode CloseHandle GetFinalPathNameByHandleW UnmapViewOfFile SetUnhandledExceptionFilter InitializeSListHead AddVectoredExceptionHandler GetCurrentProcess SetWaitableTimer CreateWaitableTimerExW Process32Next Process32First CreateToolhelp32Snapshot SwitchToThread GetCurrentThreadId GetCurrentThread WideCharToMultiByte GetUserPreferredUILanguages RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WaitForSingleObject MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency CreateThread SleepEx QueryPerformanceCounter ExitProcess CreateEventW CompareStringOrdinal CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW WaitForMultipleObjects GetExitCodeProcess CreateEventA RemoveVectoredExceptionHandler SetThreadStackGuarantee

advapi32

ImpersonateAnonymousToken RevertToSelf GetTokenInformation RegCloseKey RegEnumKeyExW RegQueryValueExW SystemFunction036 RegOpenKeyExW OpenProcessToken

oleaut32

SysStringLen SysFreeString GetErrorInfo

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile

ws2_32

WSAIoctl WSASocketW ioctlsocket connect getsockopt getsockname WSAGetLastError shutdown bind closesocket getpeername WSAStartup WSACleanup getaddrinfo freeaddrinfo send setsockopt recv WSASend

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertOpenStore CertDuplicateStore

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

OpenClipboard GetClipboardData DefWindowProcA RegisterClassExA CreateWindowExA ReleaseDC GetDC DestroyIcon CreateIcon MapVirtualKeyW SetWindowLongW GetCursorPos SendInput CloseClipboard GetWindowLongPtrW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW RegisterRawInputDevices SetWindowLongPtrW ShowWindow MessageBoxW GetSystemMetrics RedrawWindow FlashWindowEx GetClientRect CreateWindowExW RegisterClassExW DestroyWindow MonitorFromPoint ValidateRect SetWindowTextW TrackPopupMenu SetMenuDefaultItem EnableMenuItem PostMessageW GetForegroundWindow GetActiveWindow EmptyClipboard SetWindowPos GetSystemMenu ClientToScreen IsWindowVisible SetClipboardData LoadCursorW SetCursor ReleaseCapture ChangeDisplaySettingsExW GetWindowPlacement SetWindowPlacement GetMonitorInfoW MonitorFromWindow DefWindowProcW GetRawInputData GetWindowLongW GetMenu AdjustWindowRectEx MapVirtualKeyExW GetKeyboardState GetKeyboardLayout ToUnicodeEx TrackMouseEvent ScreenToClient GetTouchInputInfo MonitorFromRect CloseTouchInputHandle GetWindowRect SetCapture SystemParametersInfoA GetClipCursor ClipCursor ShowCursor GetKeyState IsIconic SetForegroundWindow SetWindowDisplayAffinity RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware DestroyCursor RegisterWindowMessageA InvalidateRgn SendMessageW VkKeyScanW

shell32

ShellExecuteW DragQueryFileW DragFinish

gdi32

SelectObject CreateDIBSection SetPixelFormat DeleteDC GetDeviceCaps CreateRectRgn DescribePixelFormat BitBlt GetPixelFormat ChoosePixelFormat SwapBuffers DeleteObject CreateCompatibleDC

opengl32

wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglCreateContext

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

memset memcmp __CxxFrameHandler3 _CxxThrowException __C_specific_handler memcpy __current_exception __current_exception_context memmove

api-ms-win-crt-math-l1-1-0

fmod pow ceil tan round sin cos exp2f exp2 truncf ceilf roundf _hypotf powf tanf fmax fminf acos floor acosf fmaxf fmodf sinf floorf trunc __setusermatherr cosf fmaf atan2

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit strerror _set_app_type _register_thread_local_exe_atexit_callback _crt_atexit __p___argv __p___argc _configure_narrow_argv _exit terminate exit _initterm_e _initterm _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_c9d63088b5bde4dd67ba6b344b828967_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

oleaut32

ntdll

ws2_32

bcrypt

crypt32

secur32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

shell32

gdi32

opengl32

d3dcompiler_47

ole32

imm32

uxtheme

dwmapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic