2026-08-04_d2990e9d8acc8ff4cb29a9c28122064f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_d2990e9d8acc8ff4cb29a9c28122064f_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.5MB
Sample260804-rcmf3ascqe
SHA256 192cb5d907535841ff6632e4c29c4737140bb6cd906cb3bfa8ece3fbb5a0e744
MD5 d2990e9d8acc8ff4cb29a9c28122064f
SHA1 3112f741f37a5aba79d711f36e1756e845cd8bab
SHA512 564b95199fb6394e9b3a480774eb207fc4e752f6c65277e1f74e9e780057328c93622100c6d5be6bb29e6dd28271c49d15c927775ed00a0072a91a7e20526c28
SSDEEP 49152:Ln7UmNxVrzLxVEd+BcB06iSmaS+LGhk3uLmCNURGDMJAzvXdqCPYIU6iOR:VzLgbmatPuEGgKn+O
TLSH
T171F55C03E69580E8C4ADC478835AD133EA33BC8E4A35B2EB6BD45B212F35F906B1D755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_d2990e9d8acc8ff4cb29a9c28122064f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-04_d2990e9d8acc8ff4cb29a9c28122064f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.5MB

2026-08-04_d2990e9d8acc8ff4cb29a9c28122064f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d517a5176ef7e407828c19a44e7d311d
SHA256 192cb5d907535841ff6632e4c29c4737140bb6cd906cb3bfa8ece3fbb5a0e744
MD5 d2990e9d8acc8ff4cb29a9c28122064f
SHA1 3112f741f37a5aba79d711f36e1756e845cd8bab
SHA512 564b95199fb6394e9b3a480774eb207fc4e752f6c65277e1f74e9e780057328c93622100c6d5be6bb29e6dd28271c49d15c927775ed00a0072a91a7e20526c28
SSDEEP 49152:Ln7UmNxVrzLxVEd+BcB06iSmaS+LGhk3uLmCNURGDMJAzvXdqCPYIU6iOR:VzLgbmatPuEGgKn+O
TLSH
T171F55C03E69580E8C4ADC478835AD133EA33BC8E4A35B2EB6BD45B212F35F906B1D755
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2500304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mda.pdb

bcryptprimitives

ProcessPrng

kernel32

CreateEventW CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle DeleteFileW CopyFileExW DeviceIoControl ExitProcess SetWaitableTimer GetFileType GetExitCodeProcess FindNextFileW GetSystemTimeAsFileTime GetLastError CloseHandle CreateDirectoryW Sleep GetModuleHandleA GetProcAddress GetSystemTimePreciseAsFileTime ReadConsoleW SetThreadStackGuarantee FindFirstFileExW SetFileTime GetFullPathNameW CreateThread SetHandleInformation GetCurrentThread GetConsoleMode ReadFileEx WriteConsoleW WaitForSingleObject SetConsoleMode GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx GetCurrentThreadId GetConsoleScreenBufferInfo SetConsoleTextAttribute GetFileInformationByHandle GetFileInformationByHandleEx GetStdHandle FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleCursorPosition GetNumberOfConsoleInputEvents CancelIoEx WriteFile ReadConsoleInputW SetConsoleCursorInfo SetFileCompletionNotificationModes CreateIoCompletionPort GetConsoleCursorInfo GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError WaitForMultipleObjects CreateFileW RemoveDirectoryW SleepEx WriteFileEx CreateSymbolicLinkW FindClose SwitchToThread SetFileInformationByHandle CreateWaitableTimerExW InitializeSListHead SetUnhandledExceptionFilter GetCommandLineW AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc SetEnvironmentVariableW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

ToUnicodeEx GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow

ws2_32

WSASocketW ioctlsocket connect closesocket recv setsockopt getpeername WSAStartup WSACleanup WSAGetLastError getsockname bind getaddrinfo WSAIoctl WSASend shutdown send freeaddrinfo getsockopt

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtOpenFile NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

memcpy memcmp __CxxFrameHandler3 memmove memset __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

fma ceil pow trunc round __setusermatherr fmod truncf

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe __p___argc __p___argv _cexit exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _get_initial_narrow_environment terminate _initialize_narrow_environment _configure_narrow_argv _exit _c_exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_d2990e9d8acc8ff4cb29a9c28122064f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

user32

ws2_32

ntdll

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic