2026-08-08_ca993098b9b2097a4551faa5219bce04_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_ca993098b9b2097a4551faa5219bce04_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 33.7MB
Sample260808-c75tkagk8v
SHA256 537fcb0758ec5c063dd9d45b4d79db007438dd978924c22ca8b57c425fba0e1e
MD5 ca993098b9b2097a4551faa5219bce04
SHA1 954177e6a6e1bd1a823e74a2a34a8728ece212aa
SHA512 8fba0a968c6c50473068ddcd83c348244f2e907f36670034ab278b6dfeb430960399b2dba0f577e8c6cc19eaf5ab1a5079b2b44b29ff11d1cb958b44d6e4db52
SSDEEP 393216:DEpcxwCmFeDJ/AXGyMPc4Cow8gukLk/Z8+x1YrlDqUnJBM3Y7Oms:DQcxt5AXG3Pc4ClAmr8YJBWYyms
TLSH
T1BD77D0C2ABD386FCC435C435C64A2A72F662784A07362DAF7BD44A107F71F90DA29E15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_ca993098b9b2097a4551faa5219bce04_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-08_ca993098b9b2097a4551faa5219bce04_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 33.7MB

2026-08-08_ca993098b9b2097a4551faa5219bce04_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 40987f62e8543bc1d330f4e05d9d1627
SHA256 537fcb0758ec5c063dd9d45b4d79db007438dd978924c22ca8b57c425fba0e1e
MD5 ca993098b9b2097a4551faa5219bce04
SHA1 954177e6a6e1bd1a823e74a2a34a8728ece212aa
SHA512 8fba0a968c6c50473068ddcd83c348244f2e907f36670034ab278b6dfeb430960399b2dba0f577e8c6cc19eaf5ab1a5079b2b44b29ff11d1cb958b44d6e4db52
SSDEEP 393216:DEpcxwCmFeDJ/AXGyMPc4Cow8gukLk/Z8+x1YrlDqUnJBM3Y7Oms:DQcxt5AXG3Pc4ClAmr8YJBWYyms
TLSH
T1BD77D0C2ABD386FCC435C435C64A2A72F662784A07362DAF7BD44A107F71F90DA29E15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28217999

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeEnvironmentStringsW

oleaut32

SafeArrayUnaccessData

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll

user32

RemoveMenu

shell32

DragQueryFileW

ole32

CoSetProxyBlanket

gdi32

SetBkMode

dwmapi

DwmEnableBlurBehindWindow

comctl32

RemoveWindowSubclass

shlwapi

SHStrDupW

advapi32

RegOpenKeyExW

hid

HidD_GetManufacturerString

crypt32

CertAddCertificateContextToStore

bcrypt

BCryptGenRandom

version

GetFileVersionInfoW

secur32

DecryptMessage

psapi

GetModuleBaseNameW

ws2_32

getsockopt

winmm

timeBeginPeriod

xinput1_4

XInputGetState

setupapi

SetupDiGetClassDevsW

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

wtsapi32

WTSRegisterSessionNotification

vcruntime140

memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

powf

api-ms-win-crt-string-l1-1-0

wcscmp

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.9MB

Virtual Size

11.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.{U)

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.J7_

Size

1024B

Virtual Size

656B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zWl

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_ca993098b9b2097a4551faa5219bce04_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

oleaut32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

user32

shell32

ole32

gdi32

dwmapi

comctl32

shlwapi

advapi32

hid

crypt32

bcrypt

version

secur32

psapi

ws2_32

winmm

xinput1_4

setupapi

dxgi

d3d11

dcomp

d2d1

dwrite

wtsapi32

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic