2026-07-27_cb324a769e7e26964c9fb48b4e01d8c5_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_cb324a769e7e26964c9fb48b4e01d8c5_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 6.2MB
Sample260727-jsfpfsycjf
SHA256 dafb0f98239abb5bd278345f05156ee6495a6c71e682e8caf043275cf33e29b1
MD5 cb324a769e7e26964c9fb48b4e01d8c5
SHA1 9fb0b885f29e98489eca9b881df73e793388dc1d
SHA512 dc212f5a042800be38a61edb3943fd24ed8be21abe92f43853787ff4d217e0146a2f7840a86831ebde04afd88a096a175a52b03dff024361bda0985de6129f28
SSDEEP 98304:+82ntmqfU0iPR6kdhhsMJ+/DzqE/pI11Bm9DN37WVQxd:Mn1yDGOyDJ8Ed
TLSH
T151564A42F66290E8C46AC575D30A6232FA32BC89473539EB5BE04B313E65FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_cb324a769e7e26964c9fb48b4e01d8c5_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-27_cb324a769e7e26964c9fb48b4e01d8c5_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 6.2MB

2026-07-27_cb324a769e7e26964c9fb48b4e01d8c5_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 8ac34621aae239008ce3f5374444fa9a
SHA256 dafb0f98239abb5bd278345f05156ee6495a6c71e682e8caf043275cf33e29b1
MD5 cb324a769e7e26964c9fb48b4e01d8c5
SHA1 9fb0b885f29e98489eca9b881df73e793388dc1d
SHA512 dc212f5a042800be38a61edb3943fd24ed8be21abe92f43853787ff4d217e0146a2f7840a86831ebde04afd88a096a175a52b03dff024361bda0985de6129f28
SSDEEP 98304:+82ntmqfU0iPR6kdhhsMJ+/DzqE/pI11Bm9DN37WVQxd:Mn1yDGOyDJ8Ed
TLSH
T151564A42F66290E8C46AC575D30A6232FA32BC89473539EB5BE04B313E65FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4606144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dadaxolhub.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtQueryInformationProcess RtlAdjustPrivilege RtlGetVersion NtSetSystemInformation NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile

kernel32

GetModuleHandleW GetCurrentProcess OpenProcess FlsAlloc FlsGetValue SleepConditionVariableSRW FlsSetValue lstrlenW WakeAllConditionVariable GetTickCount64 AcquireSRWLockExclusive FlsFree GlobalMemoryStatusEx GetSystemTimePreciseAsFileTime RtlPcToFileHeader InitializeSListHead SetUnhandledExceptionFilter GetUserDefaultUILanguage LCIDToLocaleName RtlUnwindEx LoadLibraryW WaitForSingleObject RaiseException SleepEx ReleaseSRWLockExclusive DeviceIoControl GetExitCodeProcess LoadLibraryA LocalFree EncodePointer K32GetPerformanceInfo CancelIo CreateWaitableTimerExW CreateMutexA QueryFullProcessImageNameW ReadProcessMemory AddVectoredExceptionHandler CreateProcessW RtlVirtualUnwind RtlCaptureContext GetOverlappedResult VirtualAllocEx CreateEventW ReadFile ReadFileEx WriteProcessMemory VirtualFreeEx WriteFileEx VirtualProtectEx GetCurrentThreadId Module32FirstW Process32NextW Process32FirstW CreateToolhelp32Snapshot QueryPerformanceFrequency GetSystemTimes GetCurrentThread SwitchToThread QueryPerformanceCounter CreateThread CompareStringOrdinal HeapReAlloc SetLastError HeapFree SetHandleInformation RtlLookupFunctionEntry GetSystemDirectoryW GetWindowsDirectoryW TerminateProcess WaitForMultipleObjects SetThreadStackGuarantee ExitProcess GetSystemInfo WideCharToMultiByte WaitForSingleObjectEx ReleaseMutex HeapAlloc MultiByteToWideChar SetWaitableTimer FormatMessageW GetModuleFileNameW GetComputerNameExW GetProcessTimes GetProcessIoCounters VirtualQueryEx GetProcessHeap GetModuleHandleA GetDiskFreeSpaceExW GetVolumeInformationW GetDriveTypeW GetVolumePathNamesForVolumeNameW FindVolumeClose FindNextVolumeW FindFirstVolumeW FindNextFileW GetTempPathW GetFileAttributesW GetConsoleOutputCP GetConsoleMode WriteConsoleW DeleteFileW DeleteCriticalSection GetFinalPathNameByHandleW FindFirstFileExW Sleep MoveFileExW GetPriorityClass CopyFileExW RemoveDirectoryW CreateDirectoryW GetStdHandle GetSystemTimeAsFileTime SetThreadPriority GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime LoadLibraryExA GetProcAddress CreateFileW GetFullPathNameW CloseHandle OutputDebugStringA OutputDebugStringW LoadLibraryExW FreeLibrary GetLastError InitializeCriticalSectionEx SetPriorityClass GetCurrentProcessId Module32NextW FindClose DuplicateHandle GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW SetEnvironmentVariableW GetEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

DrawMenuBar SetMenuItemInfoW DrawIconEx SetMenu CheckMenuItem EnableMenuItem CreateIcon AppendMenuW CreatePopupMenu SetParent GetWindowLongPtrW RegisterRawInputDevices SystemParametersInfoW InsertMenuW SystemParametersInfoA IsProcessDPIAware TrackPopupMenu ShowWindow PostQuitMessage GetDC DrawTextW ReleaseDC GetWindowDC OffsetRect EnumDisplaySettingsW ChangeDisplaySettingsW CreateIconIndirect MapWindowPoints RemoveMenu DestroyIcon GetMenuBarInfo VkKeyScanW CreateAcceleratorTableW DestroyAcceleratorTable SetSystemCursor DestroyCursor MessageBoxW GetWindowRect DestroyMenu MsgWaitForMultipleObjectsEx ShowCursor ClipCursor GetClipCursor TranslateAcceleratorW GetSystemMenu SetWindowLongW GetKeyState ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetMenu GetWindowTextLengthW GetWindowTextW GetKeyboardState GetMenuItemInfoW CreateMenu EnumChildWindows DispatchMessageA GetMessageA SetPropW RegisterWindowMessageA SetWindowRgn SetWindowDisplayAffinity SetForegroundWindow RegisterTouchWindow IsWindow AdjustWindowRectEx RegisterClassExW FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos FindWindowExW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect ValidateRect SetCursor LoadCursorW GetParent CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture ReleaseCapture FillRect GetMonitorInfoW MonitorFromRect ClientToScreen GetWindowLongW ScreenToClient GetWindow SetWindowLongPtrW PostThreadMessageW PeekMessageW UnhookWindowsHookEx SetWindowsHookExW DispatchMessageW TranslateMessage GetMessageW CreateWindowExW RegisterClassW WindowFromPoint IsWindowEnabled EnableWindow MonitorFromWindow IsIconic IsWindowVisible SendMessageW GetClientRect PostMessageW RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint SetFocus DefWindowProcW GetRawInputData MapVirtualKeyW GetWindowThreadProcessId GetForegroundWindow GetAsyncKeyState GetSystemMetrics GetCursorPos CallNextHookEx SendInput SetWindowTextW

advapi32

OpenProcessToken RegQueryValueExW CopySid RegSetValueExW GetLengthSid IsValidSid GetTokenInformation RegGetValueW RegEnumKeyExW AdjustTokenPrivileges RegCloseKey RegOpenKeyExW LookupPrivilegeValueW RegDeleteTreeW RegCreateKeyExW RegDeleteValueW EventRegister EventSetInformation EventWriteTransfer EventUnregister

gdi32

SelectObject CombineRgn DeleteDC BitBlt CreateCompatibleDC GetDeviceCaps SetTextColor SetBkMode CreateSolidBrush CreateDIBSection CreateRectRgn CreateBitmap DeleteObject SetDeviceGammaRamp

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

comctl32

DefSubclassProc RemoveWindowSubclass TaskDialogIndirect SetWindowSubclass

ole32

CoTaskMemAlloc RevokeDragDrop CoUninitialize CoCreateInstance OleInitialize RegisterDragDrop CoInitializeEx CoTaskMemFree CoCreateFreeThreadedMarshaler

shell32

CommandLineToArgvW DragQueryFileW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW DragFinish

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

ws2_32

WSAGetLastError closesocket bind WSACleanup WSAStartup connect getsockname WSASocketW select ioctlsocket getsockopt freeaddrinfo getaddrinfo

psapi

GetProcessMemoryInfo GetModuleFileNameExW EmptyWorkingSet

crypt32

CryptProtectData CryptUnprotectData

pdh

PdhGetFormattedCounterValue PdhEnumObjectsW PdhOpenQueryW PdhGetFormattedCounterArrayW PdhCloseQuery PdhCollectQueryData PdhAddEnglishCounterW PdhRemoveCounter

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfTable2

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

round __setusermatherr sin cos roundf floor pow powf trunc

api-ms-win-crt-string-l1-1-0

wcscmp wcslen _wcsicmp strcpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode realloc free malloc calloc

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _initialize_narrow_environment exit _crt_atexit _exit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _configure_narrow_argv _set_app_type _cexit _seh_filter_exe _register_onexit_function abort _initterm_e terminate __p___argc __p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_cb324a769e7e26964c9fb48b4e01d8c5_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

user32

advapi32

gdi32

oleaut32

comctl32

ole32

shell32

dwmapi

shlwapi

ws2_32

psapi

crypt32

pdh

iphlpapi

powrprof

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic