2026-08-03_d7e721aff044076e3528aa2b018e985c_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_d7e721aff044076e3528aa2b018e985c_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz
Size 6.6MB
Sample260804-lewvmawgrg
SHA256 deb6bec957494d6db07f5d735283afa418cb074dd19476677a5422f6783c1550
MD5 d7e721aff044076e3528aa2b018e985c
SHA1 d0ef0a413e26786ac5c9b6c23e1544e8467a0a25
SHA512 eb2333e5a775d5e45b78db2a26be251179f5d93c07a250bac2740890c2eace6be1217b895d65f0d670d8bb23ea944d505142d96160f73854e7388a4234593d00
SSDEEP 98304:BXsRgevC4ykycD/AWFVxoidY8Rh0bCt/6jlmek93+J5eCczx/KZW/Dmn+m:6tNTbUcv9c5eCc9SZWQ
TLSH
T15D66BF07E29081ECC09EC0B8C35BA637EB72B8C94535B19F5BE44B512F26F906B1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_d7e721aff044076e3528aa2b018e985c_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

File Explorer

2026-08-03_d7e721aff044076e3528aa2b018e985c_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

.exe 6.6MB

2026-08-03_d7e721aff044076e3528aa2b018e985c_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

IMPHASH 8ab195e37d9e830667ea8b9d32b1b5e9
SHA256 deb6bec957494d6db07f5d735283afa418cb074dd19476677a5422f6783c1550
MD5 d7e721aff044076e3528aa2b018e985c
SHA1 d0ef0a413e26786ac5c9b6c23e1544e8467a0a25
SHA512 eb2333e5a775d5e45b78db2a26be251179f5d93c07a250bac2740890c2eace6be1217b895d65f0d670d8bb23ea944d505142d96160f73854e7388a4234593d00
SSDEEP 98304:BXsRgevC4ykycD/AWFVxoidY8Rh0bCt/6jlmek93+J5eCczx/KZW/Dmn+m:6tNTbUcv9c5eCc9SZWQ
TLSH
T15D66BF07E29081ECC09EC0B8C35BA637EB72B8C94535B19F5BE44B512F26F906B1D75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3271088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qns_app.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtCreateFile

kernel32

RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess WideCharToMultiByte MultiByteToWideChar HeapAlloc FreeEnvironmentStringsW DuplicateHandle FormatMessageW GetModuleFileNameW SetHandleInformation CompareStringOrdinal LoadLibraryW GetSystemTimePreciseAsFileTime SetWaitableTimer ExitProcess GetSystemDirectoryW GetWindowsDirectoryW WaitForMultipleObjects QueryPerformanceCounter QueryPerformanceFrequency GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext SleepEx LoadLibraryA SetLastError lstrlenW LocalFree AddVectoredExceptionHandler Process32NextW Process32FirstW CreateToolhelp32Snapshot SetEnvironmentVariableW HeapReAlloc HeapFree GetFileAttributesW CreateProcessW CancelIo CreateEventW CreateWaitableTimerExW ReadFileEx WriteFileEx CreateThread CopyFileExW DeleteFileW GetTempPathW GetFileInformationByHandle SetFileTime GetProcessHeap GetFullPathNameW CreateDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetCurrentThread GetStdHandle CreateMutexA SetThreadStackGuarantee GetExitCodeProcess WaitForSingleObject GetProcessId CreateFileW GetShortPathNameW GetFileInformationByHandleEx GetCurrentProcessId GetModuleHandleW ReleaseMutex LCIDToLocaleName GetUserDefaultUILanguage SetFileInformationByHandle MoveFileExW FlushFileBuffers ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId SwitchToThread CancelIoEx SetFileCompletionNotificationModes CreateIoCompletionPort GetSystemTimeAsFileTime GetSystemInfo GetQueuedCompletionStatusEx GetFinalPathNameByHandleW ReadFile PostQueuedCompletionStatus SetUnhandledExceptionFilter WriteFile GetOverlappedResult LoadLibraryExA GetModuleHandleA Sleep GetProcAddress CreateMutexW FindFirstFileExW OutputDebugStringA OutputDebugStringW LoadLibraryExW FreeLibrary GetLastError CloseHandle FindClose FindNextFileW GetTimeZoneInformationForYear InitializeSListHead GetEnvironmentStringsW

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmSetWindowAttribute

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

SetWindowRgn FindWindowExW GetParent CreateWindowExW CloseTouchInputHandle SetWindowLongPtrW GetMessageW AdjustWindowRect RedrawWindow RegisterTouchWindow GetWindowLongPtrW IsWindow SetCursorPos UpdateWindow InvalidateRect GetForegroundWindow IsWindowEnabled RegisterClassExW SetWindowPos SetWindowTextW IsWindowVisible GetWindowTextW GetWindowTextLengthW KillTimer EnableWindow SetParent SetPropW GetKeyboardState EnumDisplayMonitors SetTimer MonitorFromPoint GetMessageA TranslateMessage SetWindowDisplayAffinity MonitorFromRect ToUnicodeEx GetKeyState MapVirtualKeyExW GetKeyboardLayout ShowCursor ClipCursor GetSystemMetrics GetClipCursor DispatchMessageA EnumChildWindows DefWindowProcW DestroyWindow PostThreadMessageW IsIconic GetWindowPlacement SetCursor GetMonitorInfoW PeekMessageW SetWindowPlacement ChangeDisplaySettingsExW LoadCursorW GetSystemMenu RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture SetCapture GetWindow GetTouchInputInfo ScreenToClient RegisterWindowMessageA IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem SetFocus DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu DispatchMessageW MsgWaitForMultipleObjectsEx TrackMouseEvent PostMessageW FlashWindowEx TranslateAcceleratorW GetAsyncKeyState FindWindowW GetMenuItemInfoW ChangeWindowMessageFilterEx RegisterClassW SendMessageW GetRawInputData ValidateRect SetWindowLongW MapVirtualKeyW GetUpdateRect SystemParametersInfoW

comctl32

DefSubclassProc TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass

ole32

CoUninitialize CoInitializeEx RegisterDragDrop CoCreateInstance OleInitialize CoCreateFreeThreadedMarshaler CoTaskMemFree RevokeDragDrop CoTaskMemAlloc

shlwapi

SHCreateMemStream

shell32

DragQueryFileW Shell_NotifyIconW IsUserAnAdmin SHGetKnownFolderPath DragFinish ShellExecuteW SHAppBarMessage Shell_NotifyIconGetRect

gdi32

DeleteDC CreateRectRgn SetBkMode SetTextColor CreateDIBSection BitBlt CreateCompatibleDC DeleteObject GetDeviceCaps CombineRgn SelectObject CreateSolidBrush

advapi32

EventRegister EventWriteTransfer EventUnregister RegCloseKey QueryServiceStatus SystemFunction036 EventSetInformation RegGetValueW RegDeleteValueW OpenSCManagerW RegOpenKeyExW CloseServiceHandle OpenServiceW RegQueryValueExW

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

ws2_32

connect WSAGetLastError getpeername WSAIoctl WSASend shutdown freeaddrinfo getaddrinfo WSACleanup WSAStartup getsockopt WSASocketW closesocket ioctlsocket send recv select setsockopt accept listen bind getsockname

bcrypt

BCryptGenRandom

crypt32

CertOpenStore CertDuplicateCertificateContext CertCloseStore CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CryptProtectData CertDuplicateCertificateChain CertFreeCertificateChain CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateStore CryptUnprotectData

secur32

QueryContextAttributesW AcceptSecurityContext ApplyControlToken EncryptMessage DecryptMessage AcquireCredentialsHandleA FreeCredentialsHandle DeleteSecurityContext InitializeSecurityContextW FreeContextBuffer

iphlpapi

GetAdaptersAddresses

vcruntime140

__CxxFrameHandler3 __current_exception __C_specific_handler _purecall __current_exception_context wcsrchr __std_exception_copy memset __std_exception_destroy memmove memcpy memcmp _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcslen strlen wcscmp _wcsicmp

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr floor trunc pow round

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit _initialize_narrow_environment _configure_narrow_argv terminate _initterm _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_d7e721aff044076e3528aa2b018e985c_akira_cobalt-strike_glassworm_rusty-stealer_satacom_zxxz

bcryptprimitives

ntdll

kernel32

dwmapi

api-ms-win-core-synch-l1-2-0

user32

comctl32

ole32

shlwapi

shell32

gdi32

advapi32

oleaut32

ws2_32

bcrypt

crypt32

secur32

iphlpapi

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic