2026-08-08_2c0e1318c9d383a916a3536375de1ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_2c0e1318c9d383a916a3536375de1ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 10.9MB
Sample260808-hc2fjscc38
SHA256 52e70015d83514b96c369fb95f0d2f1e2b3bb7a1a999b4f882e77ef32bcd1725
MD5 2c0e1318c9d383a916a3536375de1ec7
SHA1 3fa8889142288ced2f3ed649e89f4c4b3b2872a3
SHA512 7a424e02ac3b6f3440912f889ff4a4a220b9d196f4383850a8d524c3acc5208af30554db2b4e98314d6193e15795b69b636f11ed36747b5faeaf1b9cb66da63e
SSDEEP 98304:6ImmSUuw53YSYMVNJeuss9H8NU/8FiC0ZoYDJWltofTUwlc+AJARACe:37EwRxNJkHWoAJCRA
TLSH
T12EB61911BA5BA8ACC19AC870834646731A3170CB1B36B9FF44D592793F69AF45F3C728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_2c0e1318c9d383a916a3536375de1ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-08_2c0e1318c9d383a916a3536375de1ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 10.9MB

2026-08-08_2c0e1318c9d383a916a3536375de1ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 1dbb80c6068cb0eb365eb3163e01ffe3
SHA256 52e70015d83514b96c369fb95f0d2f1e2b3bb7a1a999b4f882e77ef32bcd1725
MD5 2c0e1318c9d383a916a3536375de1ec7
SHA1 3fa8889142288ced2f3ed649e89f4c4b3b2872a3
SHA512 7a424e02ac3b6f3440912f889ff4a4a220b9d196f4383850a8d524c3acc5208af30554db2b4e98314d6193e15795b69b636f11ed36747b5faeaf1b9cb66da63e
SSDEEP 98304:6ImmSUuw53YSYMVNJeuss9H8NU/8FiC0ZoYDJWltofTUwlc+AJARACe:37EwRxNJkHWoAJCRA
TLSH
T12EB61911BA5BA8ACC19AC870834646731A3170CB1B36B9FF44D592793F69AF45F3C728
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7499184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

arity.pdb

bcryptprimitives

ProcessPrng

kernel32

CloseHandle GetSystemTimeAsFileTime SetConsoleTextAttribute SetConsoleMode GetLastError Sleep GetProcAddress GetModuleHandleA GetConsoleMode GetStdHandle GetSystemInfo FreeLibrary WriteConsoleA GetConsoleScreenBufferInfo SetFileAttributesW MoveFileExW GetFileInformationByHandle FindNextFileW WaitForMultipleObjects FormatMessageW GetModuleHandleW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP MultiByteToWideChar ReadConsoleW GetModuleFileNameW HeapAlloc DeleteFileW InitializeSListHead SetUnhandledExceptionFilter WriteConsoleW GetFinalPathNameByHandleW ReleaseMutex GetEnvironmentVariableA WriteFile QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive GetProcessTimes GetCurrentProcess SwitchToThread TlsAlloc TlsSetValue TlsFree GetCurrentProcessorNumber VirtualAlloc VirtualFree VirtualQuery GetModuleHandleExA LoadLibraryA RtlVirtualUnwind CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc CreateThread CreateEventW SetHandleInformation GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess WideCharToMultiByte WaitForSingleObjectEx CreateMutexA

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken SystemFunction036

bcrypt

BCryptGenRandom

ntdll

RtlNtStatusToDosError NtWriteFile NtOpenFile NtCreateNamedPipeFile NtReadFile

userenv

GetUserProfileDirectoryW

ws2_32

getsockname WSADuplicateSocketW WSAStartup WSASocketW select connect WSASend WSARecv freeaddrinfo WSACleanup closesocket getaddrinfo WSAGetLastError setsockopt getsockopt ioctlsocket recv send getpeername

vcruntime140

memcmp __std_terminate __current_exception _CxxThrowException memset memmove memcpy __CxxFrameHandler3 __current_exception_context __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _set_app_type terminate _configure_narrow_argv exit _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment _seh_filter_exe _errno _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _initterm _exit _initialize_narrow_environment _initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __acrt_iob_func fputs

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr trunc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_2c0e1318c9d383a916a3536375de1ec7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

bcrypt

ntdll

userenv

ws2_32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic