2026-07-24_ddfaa3b981896c1b7298146770620fe7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-24_ddfaa3b981896c1b7298146770620fe7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 11.3MB
Sample260724-a3afraytfz
SHA256 2bbb7611ca6be661543a6229bfc623a3cb0b67c89c34f86b7fa63926c561e2a2
MD5 ddfaa3b981896c1b7298146770620fe7
SHA1 e9b26d99b711a2c62167feea4ea42e37ec640ad2
SHA512 11d823eb25f3be9d9975089ecfc6975c6e1fbf5acb652e5849f1b3e7bb054f506708f74763c6acf6f9310971330e862a5a6fc608f362e07225c5ef8aaa0065f8
SSDEEP 98304:gpi/4RvllziFlfMwq7tr8wC+O271EF4MAEXlPOePQI2sSHAJB:Aw4RvllziFlfMwMtr8wC+OSlEeIf
TLSH
T10DC6E7257B5E99A8C09BC47483478AA2493130DB0F3979FF4498963C2F79BF56F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-24_ddfaa3b981896c1b7298146770620fe7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-24_ddfaa3b981896c1b7298146770620fe7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 11.3MB

2026-07-24_ddfaa3b981896c1b7298146770620fe7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 8feeec2bf46eb81ff9a5fbb6ec24c30d
SHA256 2bbb7611ca6be661543a6229bfc623a3cb0b67c89c34f86b7fa63926c561e2a2
MD5 ddfaa3b981896c1b7298146770620fe7
SHA1 e9b26d99b711a2c62167feea4ea42e37ec640ad2
SHA512 11d823eb25f3be9d9975089ecfc6975c6e1fbf5acb652e5849f1b3e7bb054f506708f74763c6acf6f9310971330e862a5a6fc608f362e07225c5ef8aaa0065f8
SSDEEP 98304:gpi/4RvllziFlfMwq7tr8wC+O271EF4MAEXlPOePQI2sSHAJB:Aw4RvllziFlfMwMtr8wC+OSlEeIf
TLSH
T10DC6E7257B5E99A8C09BC47483478AA2493130DB0F3979FF4498963C2F79BF56F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8148128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

helix_gui.pdb

kernel32

SetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW MultiByteToWideChar GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW CreateProcessW GetWindowsDirectoryW WriteConsoleW GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency GetConsoleOutputCP CreateWaitableTimerExW HeapReAlloc SetFileTime SetHandleInformation SetFileInformationByHandle OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW FreeLibrary GetFullPathNameW SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal SetWaitableTimer LoadLibraryA GetEnvironmentVariableW lstrlenW GetCurrentThreadId GetTempPathW FindNextFileW GetConsoleMode GetFileInformationByHandle GetFileAttributesW GetQueuedCompletionStatusEx LCIDToLocaleName GetSystemDirectoryW SetFileCompletionNotificationModes CancelIoEx CreateIoCompletionPort LoadLibraryW PostQueuedCompletionStatus WriteFile GetOverlappedResult ReadFile CreateFileW SetNamedPipeHandleState GetUserDefaultUILanguage ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GetModuleHandleW SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader CloseHandle RaiseException FlsAlloc GetModuleHandleA Sleep GetProcAddress FlsGetValue FlsSetValue FlsFree EncodePointer FormatMessageW LoadLibraryExA GetLastError InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx HeapAlloc InitializeCriticalSectionEx HeapFree GetProcessHeap DeleteCriticalSection

advapi32

RegOpenKeyExW RegQueryValueExW RegGetValueW SystemFunction036 EventUnregister EventWriteTransfer RegCloseKey EventSetInformation EventRegister

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtCreateFile RtlNtStatusToDosError NtCancelIoFileEx NtReadFile NtDeviceIoControlFile NtOpenFile NtCreateNamedPipeFile RtlGetVersion

shlwapi

SHCreateMemStream

ole32

CoTaskMemAlloc RevokeDragDrop RegisterDragDrop CoInitializeEx OleInitialize CoCreateInstance CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler

user32

DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu CreateWindowExW TrackPopupMenu PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar SetWindowPos CreatePopupMenu CreateMenu DrawIconEx GetMenuItemInfoW CreateIcon GetKeyboardLayout ToUnicodeEx MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState RegisterClassExW EnableMenuItem PostMessageW GetRawInputData SystemParametersInfoA SetPropW GetMessageA TranslateMessage DispatchMessageA SetForegroundWindow GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible SetWindowTextW GetWindowTextW GetWindowTextLengthW EnumChildWindows EnumDisplayMonitors MonitorFromPoint DestroyIcon SetWindowDisplayAffinity ReleaseCapture AdjustWindowRect SetCapture MsgWaitForMultipleObjectsEx DestroyWindow RegisterRawInputDevices VkKeyScanW SetWindowLongW RegisterWindowMessageA GetWindow SetParent MapWindowPoints SetFocus RedrawWindow IsIconic ShowWindow GetSystemMenu AdjustWindowRectEx ReleaseDC GetDC SendInput EnableWindow IsWindow GetSystemMetrics IsWindowEnabled GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn RegisterTouchWindow IsProcessDPIAware TranslateAcceleratorW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos GetClientRect GetWindowLongW ScreenToClient SendMessageW GetUpdateRect ValidateRect GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetMessageW ClientToScreen FlashWindowEx SetCursor LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW DefWindowProcW PostThreadMessageW MapVirtualKeyW DispatchMessageW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

comctl32

RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect DefSubclassProc

gdi32

GetDeviceCaps CreateRectRgn CombineRgn DeleteDC CreateDIBSection SelectObject DeleteObject CreateSolidBrush CreateCompatibleDC SetTextColor SetBkMode BitBlt

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shell32

DragFinish DragQueryFileW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW

secur32

FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage QueryContextAttributesW DecryptMessage DeleteSecurityContext AcquireCredentialsHandleA ApplyControlToken

ws2_32

freeaddrinfo WSASocketW WSAStartup shutdown setsockopt WSACleanup WSAIoctl closesocket getaddrinfo WSAGetLastError send getpeername recv connect ioctlsocket WSASend getsockopt getsockname bind

crypt32

CertGetCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertDuplicateStore CertEnumCertificatesInStore CertAddCertificateContextToStore CertCloseStore CertFreeCertificateChain CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateCertificateChain

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

floor round trunc pow roundf __setusermatherr

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strcpy_s wcscmp

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _c_exit _register_onexit_function _set_app_type exit _cexit _crt_atexit __p___argv _get_initial_narrow_environment _initterm __p___argc abort _initterm_e _exit terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode calloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-24_ddfaa3b981896c1b7298146770620fe7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

oleaut32

bcryptprimitives

ntdll

shlwapi

ole32

user32

api-ms-win-core-synch-l1-2-0

comctl32

gdi32

dwmapi

shell32

secur32

ws2_32

crypt32

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic