2026-08-04_6f2113b20be2503f8fe86a54a8803e0c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_6f2113b20be2503f8fe86a54a8803e0c_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 57.4MB
Sample260804-st63gatcka
SHA256 6a74094649e20a1ba7868c1db36e496ccaad6f271b38c302a7ec5d18ae178cfb
MD5 6f2113b20be2503f8fe86a54a8803e0c
SHA1 6bb3ffffab66828df605c310dc429f37279ebed2
SHA512 8af25790c5dd387bf7a9bb25ae23cabf8c15c05ab22f6792171e75a72db222d542121bbbd32f5f7dab3b35ad64ef644261e2e9da8a71f8ad3d7f9e6d67b375c7
SSDEEP 786432:FJc5HUeleQaNBzoe6srna5M5PgYeRuQus65:3c5HUNZBz13zLRPjs
TLSH
T17CD76B12BA5A556DD05AC4B4838A4B335B3174CB0B35AAFF84C456393F7AAF02B3C719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_6f2113b20be2503f8fe86a54a8803e0c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-04_6f2113b20be2503f8fe86a54a8803e0c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 57.4MB

2026-08-04_6f2113b20be2503f8fe86a54a8803e0c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 3cccbdc967e864ec9df9eb12916ac1ce
SHA256 6a74094649e20a1ba7868c1db36e496ccaad6f271b38c302a7ec5d18ae178cfb
MD5 6f2113b20be2503f8fe86a54a8803e0c
SHA1 6bb3ffffab66828df605c310dc429f37279ebed2
SHA512 8af25790c5dd387bf7a9bb25ae23cabf8c15c05ab22f6792171e75a72db222d542121bbbd32f5f7dab3b35ad64ef644261e2e9da8a71f8ad3d7f9e6d67b375c7
SSDEEP 786432:FJc5HUeleQaNBzoe6srna5M5PgYeRuQus65:3c5HUNZBz13zLRPjs
TLSH
T17CD76B12BA5A556DD05AC4B4838A4B335B3174CB0B35AAFF84C456393F7AAF02B3C719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32862576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mineru_office_convert.pdb

bcryptprimitives

ProcessPrng

kernel32

GetCommandLineW SetFileInformationByHandle GetCurrentProcessId GetSystemTimePreciseAsFileTime VirtualProtect GetProcessHeap HeapFree FindFirstFileExW FindClose HeapReAlloc lstrlenW ReleaseMutex MapViewOfFile GetModuleHandleW FormatMessageW GetModuleFileNameW ExitProcess CreateFileMappingW CreateThread GetTempPathW HeapAlloc FindNextFileW CreateDirectoryW UnmapViewOfFile GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WaitForSingleObjectEx LoadLibraryA CreateMutexA GetSystemInfo QueryPerformanceFrequency LoadLibraryW WideCharToMultiByte RtlVirtualUnwind Sleep GetModuleHandleA GetEnvironmentVariableW AddVectoredExceptionHandler ConvertFiberToThread DeleteFiber CreateFiber ConvertThreadToFiber IsThreadAFiber SwitchToFiber SetThreadStackGuarantee VirtualQuery GetFullPathNameW GetFinalPathNameByHandleW GetCurrentThreadId GetSystemTimeAsFileTime DuplicateHandle ReadConsoleW GetConsoleMode GetStdHandle TlsSetValue TlsGetValue TlsAlloc InitOnceExecuteOnce AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetLastError GetLastError GetCurrentDirectoryW RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter WaitForSingleObject SwitchToThread GetCurrentThread CreateFileW InitializeSListHead GetFileInformationByHandleEx GetFileInformationByHandle CloseHandle AssignProcessToJobObject GetCurrentProcess SetInformationJobObject CreateJobObjectW GetProcAddress SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtOpenFile NtWriteFile NtReadFile RtlNtStatusToDosError

vcruntime140

memcmp memcpy memset memmove strchr __current_exception_context _CxxThrowException __current_exception __C_specific_handler __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

acosf __setusermatherr pow log10 acos log2f log2 log cbrt atan2 asin floorf ceilf roundf fmaf atan tanhf fma truncf tan ldexp round _hypot powf tanh cosh trunc ceil tanf cos sin exp floor fmod _hypotf expf sinf cosf sinh exp2 log10f logf fmodf exp2f atan2f

api-ms-win-crt-string-l1-1-0

strlen strcmp

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initialize_onexit_table _c_exit _cexit __p___argv __p___argc _register_onexit_function _initterm _crt_atexit terminate _register_thread_local_exe_atexit_callback _configure_narrow_argv _set_app_type _seh_filter_exe _initterm_e abort exit _exit _initialize_narrow_environment _errno _wassert

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

ftell __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf __p__commode fflush __acrt_iob_func fseek _set_fmode fclose feof ferror fgets fwrite _setmode _fileno fread fopen

api-ms-win-crt-heap-l1-1-0

free malloc realloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_6f2113b20be2503f8fe86a54a8803e0c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic