2026-07-21_085c7e5bd5eec748acf7337796d15613_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_085c7e5bd5eec748acf7337796d15613_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 2.9MB
Sample260721-e1jnvsez4m
SHA256 6bf3e49f68d8f1e6522e120aeaff0a074ff96ab8e1188fe8d1df16e3be1193e9
MD5 085c7e5bd5eec748acf7337796d15613
SHA1 35bb4a106aea331fc3228860b0c06d5b718b3e73
SHA512 53864528fe7718447aece23fc874b55c338b96b8d18221a0e7f97eb9c1d885ec8b3efdb4de4fb64c65bfcef39714f49db71f64d1bdbd7b32ef20ef454db1e132
SSDEEP 49152:7mPM2KhVSZ8LIa72S2UYSUFidJKEmhIM2pEMIS09doB5YIU6ia:Ky2ZBXUYEdSCpESDn+
TLSH
T12DE56C13E69580E9C09DC478835A9533EA33BCCD0A3572EB2BE86A112F7AF905F1C755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_085c7e5bd5eec748acf7337796d15613_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-21_085c7e5bd5eec748acf7337796d15613_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 2.9MB

2026-07-21_085c7e5bd5eec748acf7337796d15613_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d2ec418b5ae2754298391dcdcba5e4e6
SHA256 6bf3e49f68d8f1e6522e120aeaff0a074ff96ab8e1188fe8d1df16e3be1193e9
MD5 085c7e5bd5eec748acf7337796d15613
SHA1 35bb4a106aea331fc3228860b0c06d5b718b3e73
SHA512 53864528fe7718447aece23fc874b55c338b96b8d18221a0e7f97eb9c1d885ec8b3efdb4de4fb64c65bfcef39714f49db71f64d1bdbd7b32ef20ef454db1e132
SSDEEP 49152:7mPM2KhVSZ8LIa72S2UYSUFidJKEmhIM2pEMIS09doB5YIU6ia:Ky2ZBXUYEdSCpESDn+
TLSH
T12DE56C13E69580E9C09DC478835A9533EA33BCCD0A3572EB2BE86A112F7AF905F1C755
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2052768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mda.pdb

kernel32

DuplicateHandle GetSystemTimePreciseAsFileTime CopyFileExW DeviceIoControl GetFileType FindFirstFileExW SetFileTime FindNextFileW GetFullPathNameW GetFileAttributesW CreateThread SetHandleInformation ReadFileEx WriteConsoleW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CancelIo CreateEventW GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx GetCurrentThreadId GetFileInformationByHandle CreateFileW CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort WaitForMultipleObjects GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError ExitProcess Sleep SetWaitableTimer CreateWaitableTimerExW GetNumberOfConsoleInputEvents SetConsoleCursorInfo SleepEx WriteFileEx FindClose SetFileInformationByHandle DeleteFileW GetSystemTimeAsFileTime SwitchToThread GetConsoleCursorInfo ReadConsoleInputW SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetStdHandle GetFileInformationByHandleEx SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetCurrentThread SetThreadStackGuarantee GetExitCodeProcess GetLastError WaitForSingleObject CreateDirectoryW CloseHandle SetUnhandledExceptionFilter GetCommandLineW AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA GetProcAddress lstrlenW WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW InitializeSListHead QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetModuleHandleA CompareStringOrdinal GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSACleanup WSAStartup freeaddrinfo setsockopt send getsockopt connect ioctlsocket WSASocketW closesocket recv WSAIoctl shutdown WSASend getpeername getaddrinfo getsockname WSAGetLastError bind

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtWriteFile NtReadFile NtOpenFile

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

__current_exception_context memcpy __current_exception memcmp memmove __CxxFrameHandler3 memset __C_specific_handler

api-ms-win-crt-math-l1-1-0

truncf trunc __setusermatherr fma pow ceil round fmod

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _register_onexit_function _initialize_onexit_table _set_app_type _configure_narrow_argv _initterm _initterm_e _get_initial_narrow_environment _crt_atexit exit _exit __p___argc __p___argv _cexit _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_085c7e5bd5eec748acf7337796d15613_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcryptprimitives

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic