2026-08-01_a2f32c2a0046b4acc333dd6c31001e67_akira_amadey_cobalt-strike_darkgate_glassworm_rhadamanthys_rusty-stealer_satacom_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_a2f32c2a0046b4acc333dd6c31001e67_akira_amadey_cobalt-strike_darkgate_glassworm_rhadamanthys_rusty-stealer_satacom_stop
Size 9.4MB
Sample260802-aetjqaag28
SHA256 494aee3772b386e6813948f4d2826c6dcc84f2f2dcd28ecab2da5fb0cfceb822
MD5 a2f32c2a0046b4acc333dd6c31001e67
SHA1 4116217089e4f6dae8ebdab56688facd54dcbe2f
SHA512 242874e265ea4a4f0c3a4c7de1f84363a438273674707eab1e725b45261fa2a8235ede709aff64b84954a17fb62bcf7d38efce8cb256a5e91cfa09008143b59d
SSDEEP 196608:x0O3GQPDD3mOrI2iFtJfh2mqRbR+0XD12S1wOBzWI+/GjuQrSsfDcdGNC:zGGDD3mOrI2iFtJfh2mqd+eD4GBzWI+e
TLSH
T1DCA6BF02E153E13AD80310B0625EE27D7F245E2447218DEBABD4DDBB7B668D02A7F716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_a2f32c2a0046b4acc333dd6c31001e67_akira_amadey_cobalt-strike_darkgate_glassworm_rhadamanthys_rusty-stealer_satacom_stop

File Explorer

2026-08-01_a2f32c2a0046b4acc333dd6c31001e67_akira_amadey_cobalt-strike_darkgate_glassworm_rhadamanthys_rusty-stealer_satacom_stop

.exe 9.4MB

2026-08-01_a2f32c2a0046b4acc333dd6c31001e67_akira_amadey_cobalt-strike_darkgate_glassworm_rhadamanthys_rusty-stealer_satacom_stop

IMPHASH 4f05d549b3019e6f901c08b995efa896
SHA256 494aee3772b386e6813948f4d2826c6dcc84f2f2dcd28ecab2da5fb0cfceb822
MD5 a2f32c2a0046b4acc333dd6c31001e67
SHA1 4116217089e4f6dae8ebdab56688facd54dcbe2f
SHA512 242874e265ea4a4f0c3a4c7de1f84363a438273674707eab1e725b45261fa2a8235ede709aff64b84954a17fb62bcf7d38efce8cb256a5e91cfa09008143b59d
SSDEEP 196608:x0O3GQPDD3mOrI2iFtJfh2mqRbR+0XD12S1wOBzWI+/GjuQrSsfDcdGNC:zGGDD3mOrI2iFtJfh2mqd+eD4GBzWI+e
TLSH
T1DCA6BF02E153E13AD80310B0625EE27D7F245E2447218DEBABD4DDBB7B668D02A7F716
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

318328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\khkj\axion_pc\Project1\x64\Release\Project1.pdb

kernel32

IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter ReadFile SizeofResource SetHandleInformation WriteFile CreatePipe FindResourceA WaitForSingleObject SetCurrentDirectoryA Sleep GetTempPathA GetFileAttributesA LoadLibraryA LockResource CloseHandle LoadResource CreateProcessA CreateDirectoryA GetExitCodeProcess GetLocaleInfoA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceFrequency MultiByteToWideChar CreateFileA OutputDebugStringA

user32

PeekMessageW DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW SendMessageW CreateWindowExW DestroyWindow DefWindowProcW GetKeyState GetMessageExtraInfo LoadIconW PostQuitMessage TranslateMessage ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCursorPos ReleaseCapture IsWindowUnicode LoadCursorW SetCapture SetCursor GetClientRect UpdateWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetCursorPos

shell32

ShellExecuteA ShellExecuteW

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

msvcp140

_Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __current_exception __current_exception_context __C_specific_handler memset _CxxThrowException memchr memcmp memcpy memmove __std_terminate __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fread __stdio_common_vsprintf _set_fmode __p__commode _wfopen fwrite __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-string-l1-1-0

strcmp _strdup strlen

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _cexit _configure_narrow_argv _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback _beginthreadex _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

sin acosf sinf ceilf __setusermatherr cosf fmodf sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_a2f32c2a0046b4acc333dd6c31001e67_akira_amadey_cobalt-strike_darkgate_glassworm_rhadamanthys_rusty-stealer_satacom_stop

kernel32

user32

shell32

imm32

d3dcompiler_47

msvcp140

d3d11

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic