2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 18.0MB
Sample260721-23rhtaaq21
SHA256 fb2489abcd9c829e361f2bedadf40e767e0c87144efc2f7f91125394787475bf
MD5 6a2723f3f1ce5e59632b62a45ce48167
SHA1 1ecb837dcb8aab83cc855c97ecdc5b7b31d848f9
SHA512 3a74a436ae1f7bf537e4a4170501961c5c13367d3e43b62178f997a14c175f2d737f1e6626c174ae14f4e54c23ed55e5784791a10402d6361ec3f8d1d2058e6b
SSDEEP 393216:VweQTzqMschntZbM81wWbytsWKRPBWM0Q:VwLTzqMschntZbM81rbytsWW
TLSH
T19C17E7257B9B996CD09BC47483478A720A7130CB0B35B9FF449596382F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 18.0MB

2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 331ae78cc504db1e692304bff5305293
SHA256 fb2489abcd9c829e361f2bedadf40e767e0c87144efc2f7f91125394787475bf
MD5 6a2723f3f1ce5e59632b62a45ce48167
SHA1 1ecb837dcb8aab83cc855c97ecdc5b7b31d848f9
SHA512 3a74a436ae1f7bf537e4a4170501961c5c13367d3e43b62178f997a14c175f2d737f1e6626c174ae14f4e54c23ed55e5784791a10402d6361ec3f8d1d2058e6b
SSDEEP 393216:VweQTzqMschntZbM81wWbytsWKRPBWM0Q:VwLTzqMschntZbM81rbytsWW
TLSH
T19C17E7257B9B996CD09BC47483478A720A7130CB0B35B9FF449596382F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12794016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SolaraV3.pdb

kernel32

CreateWaitableTimerExW WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW DeviceIoControl GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess SetWaitableTimer FindClose FindFirstFileExW CopyFileExW RemoveDirectoryW GetCommandLineW GetTempPathW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetStdHandle FindNextFileW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW GetFullPathNameW SetLastError SetHandleInformation SleepEx WriteFileEx OutputDebugStringA OutputDebugStringW WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal LCIDToLocaleName GetEnvironmentVariableW GetUserDefaultUILanguage ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable RtlVirtualUnwind SleepConditionVariableSRW GetModuleHandleW GetSystemTimeAsFileTime lstrlenW GetConsoleMode GetFileInformationByHandle GetFileAttributesW SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx LoadLibraryA CreateProcessW WriteFile ReadFile LoadLibraryW PostQueuedCompletionStatus GetOverlappedResult RtlPcToFileHeader GetCurrentThreadId RaiseException FlsAlloc TerminateProcess OpenProcess GetModuleHandleA Sleep CreateFileW SetNamedPipeHandleState FlsGetValue FlsSetValue FormatMessageW LoadLibraryExA FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx HeapAlloc HeapFree GetProcessHeap CloseHandle InitializeCriticalSectionEx GetModuleFileNameW FreeLibrary SetThreadErrorMode GetProcAddress GetLastError GetConsoleOutputCP LoadLibraryExW DeleteCriticalSection

advapi32

SystemFunction036 EventRegister EventSetInformation RegGetValueW RegCloseKey EventWriteTransfer RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegOpenKeyExW RegQueryValueExW EventUnregister

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtOpenFile NtCreateNamedPipeFile NtReadFile RtlGetVersion NtCreateFile NtDeviceIoControlFile NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu DrawIconEx CheckMenuItem RemoveMenu CreatePopupMenu CreateWindowExW CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable SetWindowPos GetMenuItemInfoW CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW ToUnicodeEx GetKeyState GetRawInputData GetKeyboardLayout GetMenu IsWindowVisible EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput GetMessageA TranslateMessage SetForegroundWindow DestroyIcon SetWindowDisplayAffinity SystemParametersInfoA SetPropW SetWindowLongW DrawTextW GetSystemMenu ClipCursor GetClipCursor ShowCursor VkKeyScanW RegisterRawInputDevices ReleaseCapture SetCapture DispatchMessageA MsgWaitForMultipleObjectsEx RegisterWindowMessageA SetParent MapWindowPoints GetWindow RedrawWindow RegisterClassExW SetFocus ShowWindow ReleaseDC GetWindowRect EnumChildWindows IsIconic SetWindowLongPtrW GetParent MapVirtualKeyW GetWindowLongPtrW FindWindowExW SetWindowRgn GetMessageW DispatchMessageW AdjustWindowRect EnableWindow IsWindowEnabled IsProcessDPIAware GetDC TranslateAcceleratorW DestroyWindow PostMessageW PostThreadMessageW SendMessageW GetUpdateRect ValidateRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos GetClientRect GetWindowLongW ScreenToClient DefWindowProcW EnableMenuItem GetForegroundWindow ClientToScreen ChangeDisplaySettingsExW RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos PeekMessageW SetCursor LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement

comctl32

DefSubclassProc SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass

ole32

CoTaskMemAlloc CoTaskMemFree CoUninitialize RevokeDragDrop CoCreateFreeThreadedMarshaler CoInitializeEx CoCreateInstance OleInitialize RegisterDragDrop

gdi32

CreateRectRgn CreateCompatibleDC BitBlt CreateSolidBrush CombineRgn SetTextColor SetBkMode GetDeviceCaps DeleteDC SelectObject CreateDIBSection DeleteObject

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath ShellExecuteW DragQueryFileW SHAppBarMessage DragFinish SHCreateItemFromParsingName

ws2_32

WSAIoctl WSASocketW bind freeaddrinfo WSACleanup WSAStartup shutdown getaddrinfo ioctlsocket WSAGetLastError closesocket connect setsockopt send WSASend recv getsockname getpeername getsockopt

secur32

InitializeSecurityContextW FreeContextBuffer ApplyControlToken AcceptSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA DeleteSecurityContext EncryptMessage DecryptMessage QueryContextAttributesW

crypt32

CertAddCertificateContextToStore CertFreeCertificateChain CertDuplicateCertificateChain CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertCloseStore CertEnumCertificatesInStore CertOpenStore

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

strlen strcpy_s _wcsicmp wcslen wcscmp

api-ms-win-crt-math-l1-1-0

pow round roundf floor __setusermatherr trunc

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _crt_atexit _register_onexit_function _set_app_type _seh_filter_exe _c_exit _configure_narrow_argv exit _initterm_e _register_thread_local_exe_atexit_callback terminate _initialize_narrow_environment _initialize_onexit_table __p___argc _get_initial_narrow_environment _initterm abort _exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh calloc _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_6a2723f3f1ce5e59632b62a45ce48167_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

oleaut32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

user32

comctl32

ole32

gdi32

dwmapi

shlwapi

shell32

ws2_32

secur32

crypt32

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic