2026-07-31_e1f34c6c80902d16a5b699365adda05e_akira_batrat_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_e1f34c6c80902d16a5b699365adda05e_akira_batrat_cobalt-strike_glassworm_rusty-stealer_satacom
Size 19.3MB
Sample260731-hlem5swfpg
SHA256 04fa2444a6893edbb62a1bb3b4467deb0591922f6c471a536e25ae7285fd90c2
MD5 e1f34c6c80902d16a5b699365adda05e
SHA1 ed8d916df5ba57859c883315979dec1736d867ef
SHA512 cf97a33c40aaa40a207e93f96c6eb64a1a8d31ff04314b6eb55f5fcb685f1782c05ca06b75591b4d9ef235098b454099798c9ba69ab7e8bd8c54d68a63d3c16c
SSDEEP 98304:HRcHuKJwCUigYZe1mTefTNoRRv1vx0kGKl+Y8pKamEVs8lQXrg4n+bGJS5ofoVpg:xvKJlefghxlN+PpmSy3JpW+f
TLSH
T1DE175B15BE9A58ACD15AC870834787634A3174DB1B32BABF50C891353FADBF42F29718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_e1f34c6c80902d16a5b699365adda05e_akira_batrat_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-31_e1f34c6c80902d16a5b699365adda05e_akira_batrat_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 19.3MB

2026-07-31_e1f34c6c80902d16a5b699365adda05e_akira_batrat_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 28596f9c150ecd301e042d8ffa8f6075
SHA256 04fa2444a6893edbb62a1bb3b4467deb0591922f6c471a536e25ae7285fd90c2
MD5 e1f34c6c80902d16a5b699365adda05e
SHA1 ed8d916df5ba57859c883315979dec1736d867ef
SHA512 cf97a33c40aaa40a207e93f96c6eb64a1a8d31ff04314b6eb55f5fcb685f1782c05ca06b75591b4d9ef235098b454099798c9ba69ab7e8bd8c54d68a63d3c16c
SSDEEP 98304:HRcHuKJwCUigYZe1mTefTNoRRv1vx0kGKl+Y8pKamEVs8lQXrg4n+bGJS5ofoVpg:xvKJlefghxlN+PpmSy3JpW+f
TLSH
T1DE175B15BE9A58ACD15AC870834787634A3174DB1B32BABF50C891353FADBF42F29718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11711344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cuba_memorys.pdb

bcryptprimitives

ProcessPrng

kernel32

CreateMutexA GetCurrentProcessId SetConsoleCtrlHandler GetCurrentProcess WaitForSingleObjectEx TerminateProcess GetCurrentThreadId CreateFileW Sleep CancelIoEx GetModuleHandleA GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter GetCommandLineW GetSystemInfo AddVectoredExceptionHandler SetEnvironmentVariableW CopyFileExW WriteFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA WideCharToMultiByte MultiByteToWideChar GetProcessHeap HeapReAlloc HeapAlloc HeapFree GetEnvironmentVariableW GetModuleHandleW FormatMessageW CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetEnvironmentVariableA DeleteFileW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetProcessTimes WaitForMultipleObjects GetCurrentProcessorNumber VirtualAlloc VirtualFree VirtualQuery GetFinalPathNameByHandleW SetLastError WriteConsoleA GetConsoleScreenBufferInfo DuplicateHandle SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile GetQueuedCompletionStatusEx GetExitCodeProcess UnregisterWaitEx RegisterWaitForSingleObject WaitForSingleObject GetFileAttributesW CreateProcessW CancelIo SetFilePointerEx GetCurrentThread SetThreadStackGuarantee DeviceIoControl FindNextFileW SetFileInformationByHandle CreateEventW MoveFileExW ExitProcess PostQueuedCompletionStatus FindClose CloseHandle SwitchToThread CreateDirectoryW ReadConsoleW ReleaseMutex GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileTime GetFullPathNameW GetSystemTimeAsFileTime CreateThread InitializeSListHead SetHandleInformation GetStdHandle GetConsoleMode GetModuleFileNameW ReadFileEx WriteFileEx SleepEx WriteConsoleW FreeLibrary LoadLibraryExW SetThreadErrorMode GetProcAddress GetLastError GetConsoleOutputCP SetUnhandledExceptionFilter lstrlenW

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ws2_32

WSACleanup WSASocketW setsockopt send recv getaddrinfo freeaddrinfo socket shutdown WSASend WSAStartup getsockname getpeername getsockopt select connect ioctlsocket listen bind WSAGetLastError accept closesocket WSAIoctl

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateNamedPipeFile NtCreateFile NtOpenFile NtReadFile NtWriteFile

advapi32

OpenProcessToken GetUserNameW SystemFunction036 AdjustTokenPrivileges LookupPrivilegeValueA

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 memmove strstr __C_specific_handler __current_exception __current_exception_context memcpy memcmp memset _CxxThrowException

api-ms-win-crt-math-l1-1-0

exp _fdopen __setusermatherr round pow log log2 floor ceil

api-ms-win-crt-string-l1-1-0

strcat_s wcslen strlen iswctype strcmp strncmp

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode malloc calloc

api-ms-win-crt-stdio-l1-1-0

__p__commode __acrt_iob_func __stdio_common_vsprintf fputs fputc fclose __stdio_common_vsprintf_s __stdio_common_vsnprintf_s __stdio_common_vfprintf fflush _set_fmode

api-ms-win-crt-runtime-l1-1-0

_errno _configure_narrow_argv abort _register_onexit_function _seh_filter_exe _set_app_type _crt_atexit terminate _initialize_narrow_environment _initialize_onexit_table _register_thread_local_exe_atexit_callback _wassert _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxOniguruma OnigSyntaxRuby onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null tree_sitter_python tree_sitter_rust

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_e1f34c6c80902d16a5b699365adda05e_akira_batrat_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

shell32

ole32

ws2_32

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic