2026-08-05_9a5f734395c04431c7925693f0face76_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_9a5f734395c04431c7925693f0face76_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 8.0MB
Sample260805-gcvsbsec49
SHA256 a1c6280a1447c81f7aaa14d9f54aba681985ed155f5974e5f3cd9d2a3f4ae89e
MD5 9a5f734395c04431c7925693f0face76
SHA1 e30e626fbd9dea8a7c36a9fc054dfdcb1457b836
SHA512 a487ec8fbbd1733033a4bfbe75ac66aa247bb183c1d8aa4205b2422aa5e01be55f6277da715000a41ce4a6682468767d9c86ef7fbc43e73a716eeebfc4e3a6f6
SSDEEP 49152:blXGx9odvYMF11F9YuMhrWfIRtlRHntHRPPHVIJGuoCsSqzExBiOseIoQCjIO4ww:M7zwF0HVCbnJsyGV5/z0hN8ei
TLSH
T1548608157A5BA8ADC16AC87483464A731B2170CB0B36B9FB44C496393FADAF41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_9a5f734395c04431c7925693f0face76_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-05_9a5f734395c04431c7925693f0face76_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 8.0MB

2026-08-05_9a5f734395c04431c7925693f0face76_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH e745c2a55096e496cb42d90e0e5f3d21
SHA256 a1c6280a1447c81f7aaa14d9f54aba681985ed155f5974e5f3cd9d2a3f4ae89e
MD5 9a5f734395c04431c7925693f0face76
SHA1 e30e626fbd9dea8a7c36a9fc054dfdcb1457b836
SHA512 a487ec8fbbd1733033a4bfbe75ac66aa247bb183c1d8aa4205b2422aa5e01be55f6277da715000a41ce4a6682468767d9c86ef7fbc43e73a716eeebfc4e3a6f6
SSDEEP 49152:blXGx9odvYMF11F9YuMhrWfIRtlRHntHRPPHVIJGuoCsSqzExBiOseIoQCjIO4ww:M7zwF0HVCbnJsyGV5/z0hN8ei
TLSH
T1548608157A5BA8ADC16AC87483464A731B2170CB0B36B9FB44C496393FADAF41F3D718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6053376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oneharness.pdb

kernel32

CreateEventW CreateProcessW GetCurrentProcess DuplicateHandle GetCurrentThreadId WriteConsoleW ExitProcess CreateThread WaitForSingleObjectEx CreateMutexA WaitForMultipleObjects GetModuleHandleA GetProcAddress ReadConsoleW CloseHandle GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute TerminateProcess Sleep GetCurrentProcessId SwitchToThread CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject GetExitCodeProcess CreateJobObjectW SetInformationJobObject TerminateJobObject AssignProcessToJobObject ReleaseMutex GetProcessId CreateToolhelp32Snapshot Thread32First Thread32Next OpenThread ResumeThread SleepEx GlobalFree LocalFree SetThreadStackGuarantee GetCurrentThread GetConsoleOutputCP SetLastError GetLastError CreateDirectoryW InitializeSListHead GetSystemTimeAsFileTime GlobalAlloc LoadLibraryA GetFileType HeapAlloc GetTempPathW WideCharToMultiByte MultiByteToWideChar GetFileAttributesW GetWindowsDirectoryW GetSystemDirectoryW GetFullPathNameW FreeEnvironmentStringsW GetEnvironmentStringsW CancelIo ReadFile ReadFileEx CreateNamedPipeW GetModuleFileNameW FormatMessageW GetModuleHandleW GetFinalPathNameByHandleW RemoveDirectoryW MoveFileExW DeleteFileW FindFirstFileExW SetUnhandledExceptionFilter GetFileInformationByHandleEx GetFileInformationByHandle CreateFileW FindNextFileW lstrlenW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetOverlappedResult GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW AddVectoredExceptionHandler CompareStringOrdinal SetFileInformationByHandle FlushFileBuffers SetFilePointerEx GetBinaryTypeW FindClose WriteFileEx QueryPerformanceFrequency GetSystemTimePreciseAsFileTime QueryPerformanceCounter UnlockFile LockFileEx HeapReAlloc GetProcessHeap HeapFree

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

vcruntime140

memcpy __CxxFrameHandler3 memmove memcmp __current_exception_context memset __current_exception __C_specific_handler _CxxThrowException

api-ms-win-crt-math-l1-1-0

pow fmod ceil __setusermatherr trunc log2 floor

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _register_onexit_function _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _crt_atexit terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_9a5f734395c04431c7925693f0face76_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic