2026-07-20_868621243d2ff36055fd3f1588dae3bb_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_868621243d2ff36055fd3f1588dae3bb_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz
Size 7.2MB
Sample260720-ld6nfafx41
SHA256 f42d58ea3c99972141134f228bb209080ae0ad334c89f3781f8fa2ce2d3bb7f1
MD5 868621243d2ff36055fd3f1588dae3bb
SHA1 347e8fc49bb1c467144ceb6bcdf66232cd810552
SHA512 cd402fcb826dbd282fb0f592874e80382e6fc1c4d99c7252e919c6d8cf42eb563449089fa44448b97178ffdb1274438fe8db9ace9b8a6859cb6b308e24fe0c53
SSDEEP 49152:c4+PZITfs3sViMBQSzEtproGMVy4hlQ5mwtYPoRxUoeWHxZsGrbvfby+ejn3WaN5:oPkik+UQ7lYpJ5/nh/OF+iU
TLSH
T1387638217B8A98ACD05AC47483468A735A7130DB0B39B9FF44C896783F69AF55F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_868621243d2ff36055fd3f1588dae3bb_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

File Explorer

2026-07-20_868621243d2ff36055fd3f1588dae3bb_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

.exe 7.2MB

2026-07-20_868621243d2ff36055fd3f1588dae3bb_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

IMPHASH fe0f942f842065304f8c48c4624f3dd4
SHA256 f42d58ea3c99972141134f228bb209080ae0ad334c89f3781f8fa2ce2d3bb7f1
MD5 868621243d2ff36055fd3f1588dae3bb
SHA1 347e8fc49bb1c467144ceb6bcdf66232cd810552
SHA512 cd402fcb826dbd282fb0f592874e80382e6fc1c4d99c7252e919c6d8cf42eb563449089fa44448b97178ffdb1274438fe8db9ace9b8a6859cb6b308e24fe0c53
SSDEEP 49152:c4+PZITfs3sViMBQSzEtproGMVy4hlQ5mwtYPoRxUoeWHxZsGrbvfby+ejn3WaN5:oPkik+UQ7lYpJ5/nh/OF+iU
TLSH
T1387638217B8A98ACD05AC47483468A735A7130DB0B39B9FF44C896783F69AF55F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

llmshim.pdb

kernel32

GetProcAddress CreateFileW SetNamedPipeHandleState lstrlenW DuplicateHandle GetModuleHandleA Sleep GetCurrentProcess GetQueuedCompletionStatusEx CancelIoEx WriteFile GetOverlappedResult ReadFile SetFileCompletionNotificationModes CreateIoCompletionPort PostQueuedCompletionStatus CloseHandle SetHandleInformation GetSystemTimeAsFileTime FormatMessageW GetModuleHandleW GetFileType GetFileAttributesW GetConsoleOutputCP MultiByteToWideChar ReadConsoleW GetModuleFileNameW HeapAlloc SetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose InitializeSListHead GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetEnvironmentStringsW GetExitCodeProcess CreateProcessW SetUnhandledExceptionFilter GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter FindFirstFileExW GetWindowsDirectoryW RtlVirtualUnwind WaitForMultipleObjects GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo WriteConsoleW GetNumberOfConsoleInputEvents ReadConsoleInputW CompareStringOrdinal GetLastError WaitForSingleObject FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency

ws2_32

WSAIoctl send recv connect ioctlsocket setsockopt accept WSAGetLastError socket closesocket getsockopt getsockname getpeername listen WSASocketW WSASend bind shutdown WSAStartup freeaddrinfo WSACleanup getaddrinfo

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtWriteFile NtOpenFile NtCreateNamedPipeFile NtDeviceIoControlFile NtReadFile NtCancelIoFileEx NtCreateFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

user32

GetForegroundWindow GetKeyboardLayout ToUnicodeEx GetWindowThreadProcessId

vcruntime140

memset _CxxThrowException memcpy __current_exception_context memmove memcmp __CxxFrameHandler3 __current_exception __C_specific_handler

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod pow

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit _c_exit _set_app_type terminate _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_868621243d2ff36055fd3f1588dae3bb_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

kernel32

ws2_32

shell32

combase

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

bcrypt

advapi32

user32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic