2026-07-30_9f039dc2830d0385b78a2511c4baf34f_akira_cobalt-strike_glassworm_megazord_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_9f039dc2830d0385b78a2511c4baf34f_akira_cobalt-strike_glassworm_megazord_rusty-stealer
Size 2.4MB
Sample260730-3gegsshc47
SHA256 a9117cf7512f2f4ae0d8422b7467fc5351c91b73ef019777c95125d84f6e6e8c
MD5 9f039dc2830d0385b78a2511c4baf34f
SHA1 7ccab44c6e52003940bdaf5624cb3b473c798994
SHA512 34e674a26891a55bec959c69951f0b3acd78eefedf3f754250902267cbaba6287fa4d242f8db4f5d5ab0933ab6ef863e9a36fd1c2da0a99bba03ac620860779b
SSDEEP 49152:kf+0bWF4I3VWmdYNxUhCmCs24DGUmsZWlO:keHHjSc
TLSH
T1B4C51A02F65255F9C09DC034822977326A21FCA94723E6E766907E273FB5F9C3EA8744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_9f039dc2830d0385b78a2511c4baf34f_akira_cobalt-strike_glassworm_megazord_rusty-stealer

File Explorer

2026-07-30_9f039dc2830d0385b78a2511c4baf34f_akira_cobalt-strike_glassworm_megazord_rusty-stealer

.exe 2.4MB

2026-07-30_9f039dc2830d0385b78a2511c4baf34f_akira_cobalt-strike_glassworm_megazord_rusty-stealer

IMPHASH d9b165501f23310e6e4b546d751b1d36
SHA256 a9117cf7512f2f4ae0d8422b7467fc5351c91b73ef019777c95125d84f6e6e8c
MD5 9f039dc2830d0385b78a2511c4baf34f
SHA1 7ccab44c6e52003940bdaf5624cb3b473c798994
SHA512 34e674a26891a55bec959c69951f0b3acd78eefedf3f754250902267cbaba6287fa4d242f8db4f5d5ab0933ab6ef863e9a36fd1c2da0a99bba03ac620860779b
SSDEEP 49152:kf+0bWF4I3VWmdYNxUhCmCs24DGUmsZWlO:keHHjSc
TLSH
T1B4C51A02F65255F9C09DC034822977326A21FCA94723E6E766907E273FB5F9C3EA8744
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1358352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

CompatTelRunner.pdb

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CryptUnprotectData

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateMutexA CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EncodePointer FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionEx InitializeSListHead LoadLibraryA LocalFree MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

secur32

AcceptSecurityContext AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

bcrypt

BCryptGenRandom

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getsockopt ioctlsocket recv send setsockopt socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

540KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

305B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

456KB

Virtual Size

456KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_9f039dc2830d0385b78a2511c4baf34f_akira_cobalt-strike_glassworm_megazord_rusty-stealer

vmprotectsdk64

crypt32

kernel32

secur32

bcrypt

ntdll

bcryptprimitives

advapi32

ws2_32

api-ms-win-core-synch-l1-2-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic