2026-08-04_e25680abda073ed75fb9759e4c7921af_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_e25680abda073ed75fb9759e4c7921af_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 13.3MB
Sample260804-q5fcsaytfx
SHA256 759e9694a0b0ddd41eb08408f350fe639b592a986301c99a2dcf412e951219a5
MD5 e25680abda073ed75fb9759e4c7921af
SHA1 b36c7c6c7ca6a52c7f9da344eadb8d5094d1dc2d
SHA512 d9d4c7d2378a650260c0f7bd570f67e9ab0308baddb57f7df9e58f43e3d5876509ceb3f7471f5affc746a3108ee183746400561e62a58d1f5f5005d53a2f4d60
SSDEEP 98304:ysPjOgsmU8oWSmKVqkRyBRZLmx2v9fR/NGGGGGGGGGGGGGbKtBO+B0WBSJxzUN5Y:yP9fKkx2vxGGGGGGGGGGGGGQcw0ne
TLSH
T11DE607217A9A58ADC19AC47483478A725A3030DF0B39B9FF44C496793FB9AF45F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_e25680abda073ed75fb9759e4c7921af_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-04_e25680abda073ed75fb9759e4c7921af_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 13.3MB

2026-08-04_e25680abda073ed75fb9759e4c7921af_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 55c61a1492dea65111a833f47047aae3
SHA256 759e9694a0b0ddd41eb08408f350fe639b592a986301c99a2dcf412e951219a5
MD5 e25680abda073ed75fb9759e4c7921af
SHA1 b36c7c6c7ca6a52c7f9da344eadb8d5094d1dc2d
SHA512 d9d4c7d2378a650260c0f7bd570f67e9ab0308baddb57f7df9e58f43e3d5876509ceb3f7471f5affc746a3108ee183746400561e62a58d1f5f5005d53a2f4d60
SSDEEP 98304:ysPjOgsmU8oWSmKVqkRyBRZLmx2v9fR/NGGGGGGGGGGGGGbKtBO+B0WBSJxzUN5Y:yP9fKkx2vxGGGGGGGGGGGGGQcw0ne
TLSH
T11DE607217A9A58ADC19AC47483478A725A3030DF0B39B9FF44C496793FB9AF45F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9838512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

telegram_agent_mcp.pdb

bcryptprimitives

ProcessPrng

kernel32

HeapAlloc GetOverlappedResult GetConsoleMode HeapFree GetProcessHeap CreateFileW FormatMessageW GetLastError DuplicateHandle SetHandleInformation CreateIoCompletionPort SetFileCompletionNotificationModes PostQueuedCompletionStatus ReadFile GetProcAddress GetModuleHandleA Sleep SetNamedPipeHandleState CloseHandle GetCurrentProcess GetQueuedCompletionStatusEx CancelIoEx WriteFile GetSystemTimeAsFileTime GetTempPathW GetModuleHandleW GetFileAttributesW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar ReadConsoleW GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW InitializeSListHead SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry SetUnhandledExceptionFilter ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW WaitForSingleObject CompareStringOrdinal RtlVirtualUnwind GetCurrentThread RtlCaptureContext

advapi32

RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

ws2_32

accept WSASend getsockopt connect recv send WSASocketW bind listen shutdown setsockopt WSAIoctl getsockname getpeername closesocket WSAGetLastError ioctlsocket WSAStartup getaddrinfo WSACleanup freeaddrinfo

crypt32

CertAddEncodedCertificateToStore CertSetCertificateContextProperty CertFreeCertificateContext CertFreeCertificateChain CertOpenStore CertGetCertificateChain CertCreateCertificateChainEngine CertVerifyCertificateChainPolicy CertFreeCertificateChainEngine CertCloseStore

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtReadFile NtWriteFile NtOpenFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateNamedPipeFile

vcruntime140

memcpy memset __CxxFrameHandler3 _CxxThrowException __current_exception memcmp memmove __C_specific_handler __current_exception_context

api-ms-win-crt-math-l1-1-0

trunc pow __setusermatherr

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initterm _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_onexit_table _register_onexit_function _initialize_narrow_environment _crt_atexit __p___argv _get_initial_narrow_environment _cexit terminate _exit _set_app_type _seh_filter_exe __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_e25680abda073ed75fb9759e4c7921af_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

advapi32

ws2_32

crypt32

bcrypt

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic