2026-07-22_52c14076d7447bab501819a5074c6b92_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_52c14076d7447bab501819a5074c6b92_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 5.8MB
Sample260723-caa8pacn8v
SHA256 438d6e25506b9b9db734020ae7b79f4d1b7b7e8b67033157ccfdfcdcd7b5f81d
MD5 52c14076d7447bab501819a5074c6b92
SHA1 2b25d3130c764feba3a53e1e9193d85402abdd38
SHA512 c87ce17d056fe5a15cb7a8a204ec4a5bcff73e3c52117b78f42b4f4fa75eade62cccc07141f78c1b6c885a37899bde44ec5f43ff9444f431f32e0830ba0b6a46
SSDEEP 49152:JOpqjhoUPqHBpHUR1Vizal2Hjzp0SHfKFr8XxOd1/bgdaZIU6iQHoBp:5PRf2h7HSOae+6o7
TLSH
T1ED563921BF5A99EDC15AC47483474A725A3170CB0B35BAFF448486793E6AAF11F3C368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_52c14076d7447bab501819a5074c6b92_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-22_52c14076d7447bab501819a5074c6b92_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 5.8MB

2026-07-22_52c14076d7447bab501819a5074c6b92_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH f1828340255ebe70ecd05913686419ed
SHA256 438d6e25506b9b9db734020ae7b79f4d1b7b7e8b67033157ccfdfcdcd7b5f81d
MD5 52c14076d7447bab501819a5074c6b92
SHA1 2b25d3130c764feba3a53e1e9193d85402abdd38
SHA512 c87ce17d056fe5a15cb7a8a204ec4a5bcff73e3c52117b78f42b4f4fa75eade62cccc07141f78c1b6c885a37899bde44ec5f43ff9444f431f32e0830ba0b6a46
SSDEEP 49152:JOpqjhoUPqHBpHUR1Vizal2Hjzp0SHfKFr8XxOd1/bgdaZIU6iQHoBp:5PRf2h7HSOae+6o7
TLSH
T1ED563921BF5A99EDC15AC47483474A725A3170CB0B35BAFF448486793E6AAF11F3C368
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3895024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

asset_pack_builder.pdb

bcryptprimitives

ProcessPrng

kernel32

GetModuleFileNameW GetFileInformationByHandleEx SetFileInformationByHandle GetCurrentProcess SetFileTime lstrlenW LoadLibraryA SetHandleInformation GetFullPathNameW WaitForSingleObject GetFileInformationByHandle GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx WriteFile ReadFile GetCurrentThreadId CreateFileW SetNamedPipeHandleState ReleaseMutex GetModuleHandleW GetModuleHandleA GetProcAddress FormatMessageW GetLastError PostQueuedCompletionStatus GetOverlappedResult GetConsoleMode SetFileCompletionNotificationModes GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer HeapFree HeapAlloc GetProcessHeap CloseHandle InitializeCriticalSectionEx FindNextFileW RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetConsoleOutputCP WriteConsoleW RtlVirtualUnwind GetEnvironmentVariableW SetLastError HeapReAlloc MultiByteToWideChar QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA GetFinalPathNameByHandleW DeleteCriticalSection

advapi32

RegCreateKeyExW RegCreateKeyTransactedW RegOpenKeyTransactedW RegCloseKey RegQueryValueExW RegOpenKeyExW

ntdll

NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtWriteFile NtDeviceIoControlFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

WSAStartup getaddrinfo WSACleanup WSAGetLastError closesocket shutdown bind freeaddrinfo WSAIoctl connect ioctlsocket setsockopt send WSASend recv getsockopt getsockname getpeername WSASocketW

crypt32

CertDuplicateStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertOpenStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertFreeCertificateContext CertFreeCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore

secur32

DecryptMessage AcquireCredentialsHandleA FreeCredentialsHandle EncryptMessage DeleteSecurityContext InitializeSecurityContextW FreeContextBuffer QueryContextAttributesW ApplyControlToken AcceptSecurityContext

api-ms-win-crt-string-l1-1-0

strlen strcpy_s

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-heap-l1-1-0

free calloc malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

_initterm _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _initterm_e _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type abort _seh_filter_exe exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_52c14076d7447bab501819a5074c6b92_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

secur32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic