2026-08-01_34914ead6eb377c89966475ebae7142b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_34914ead6eb377c89966475ebae7142b_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 1.8MB
Sample260802-bdgn7sar9t
SHA256 092ddd561a100539f721690a6097c8630314aaefc53357de32f8807c72c5c731
MD5 34914ead6eb377c89966475ebae7142b
SHA1 8498767798b1faa651f391b78c91782f328eb67c
SHA512 fde86845fc30fa1e50376e3a0bd050147cd6af1035db951ff72e02f772352efe4002960a5ba0a1994545024a330182c4647b2dd62e1ca0133692fa3fcfff06f2
SSDEEP 24576:EAMUzfiPtdaGsMRLG2SHHK2zvIe7rzLLbC4FTthpOtYLMVdR2iKfLkKVZF:EAQNSHq21u4FT90AiyLZF
TLSH
T198956B43F666C0F8D25AC078871AA133EA327C8D473576EB67D44A243E62FD06A3D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_34914ead6eb377c89966475ebae7142b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-01_34914ead6eb377c89966475ebae7142b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 1.8MB

2026-08-01_34914ead6eb377c89966475ebae7142b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH c24fda1e2e16d8eb5ea90af6609a9fd0
SHA256 092ddd561a100539f721690a6097c8630314aaefc53357de32f8807c72c5c731
MD5 34914ead6eb377c89966475ebae7142b
SHA1 8498767798b1faa651f391b78c91782f328eb67c
SHA512 fde86845fc30fa1e50376e3a0bd050147cd6af1035db951ff72e02f772352efe4002960a5ba0a1994545024a330182c4647b2dd62e1ca0133692fa3fcfff06f2
SSDEEP 24576:EAMUzfiPtdaGsMRLG2SHHK2zvIe7rzLLbC4FTthpOtYLMVdR2iKfLkKVZF:EAQNSHq21u4FT90AiyLZF
TLSH
T198956B43F666C0F8D25AC078871AA133EA327C8D473576EB67D44A243E62FD06A3D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1374284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

test.pdb

bcryptprimitives

ProcessPrng

kernel32

WriteFile GetModuleHandleW GetProcAddress GetCurrentThreadId SetLastError GetCurrentProcess WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex PostQueuedCompletionStatus GetOverlappedResult ReadFile SetHandleInformation GetModuleHandleA GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetFileInformationByHandle WaitForSingleObject ExitProcess GetModuleFileNameW CreateWaitableTimerExW SetWaitableTimer Sleep CancelIoEx CreateIoCompletionPort SetFileCompletionNotificationModes GetSystemTimeAsFileTime SwitchToThread GetCurrentThread SetThreadStackGuarantee CreateFileW QueryPerformanceFrequency QueryPerformanceCounter AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW HeapReAlloc CreateDirectoryW FormatMessageW GetLastError InitializeSListHead HeapAlloc CloseHandle HeapFree GetProcessHeap GetQueuedCompletionStatusEx CreateThread GetFileInformationByHandleEx SetUnhandledExceptionFilter

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSASend getsockopt connect WSAStartup WSACleanup getaddrinfo freeaddrinfo recv send getsockname WSAGetLastError getpeername closesocket bind WSAIoctl setsockopt ioctlsocket WSASocketW shutdown

ntdll

NtDeviceIoControlFile NtCreateFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile

secur32

ApplyControlToken EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer QueryContextAttributesW DecryptMessage DeleteSecurityContext

crypt32

CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateCertificateContext CertEnumCertificatesInStore CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertOpenStore CertDuplicateStore

vcruntime140

memcmp memset __current_exception_context __current_exception __CxxFrameHandler3 memmove __C_specific_handler memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv terminate _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _crt_atexit _seh_filter_exe _exit __p___argc _register_onexit_function _initialize_onexit_table __p___argv _wassert _set_app_type _cexit _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_34914ead6eb377c89966475ebae7142b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

secur32

crypt32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic