2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.6MB
Sample260809-ncffzadr9z
SHA256 a8bff2438de535da728e8ae25edcbe78819627a9b68c48e7016afd36d958d42c
MD5 0f8e3672307d726baa7eb1dfdb8b3ecc
SHA1 4d1b0d758361b4667d207b5e9b5c2e12e93b93d4
SHA512 b6d4a924ef2fafaf68a2f0e6861f08da48cc8928b4ab5aef443f004680c8d740ff8280e253a5868f5dc54139d7267fd15d01723ea38388f299f61a9810d7ef3e
SSDEEP 98304:9L0dHS/XxnYk3bUlgY/xaIPopx/XA3LFpprO3w1N2n3/2+UMxzVX:aM3w1NK/SMxzV
TLSH
T166067C07F3A580E9D46AC478C20BA237FB72F8496635B69B17D45F262F63B602B1D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.6MB

2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH f6d0ca69e8c54ebdea85e3583744793f
SHA256 a8bff2438de535da728e8ae25edcbe78819627a9b68c48e7016afd36d958d42c
MD5 0f8e3672307d726baa7eb1dfdb8b3ecc
SHA1 4d1b0d758361b4667d207b5e9b5c2e12e93b93d4
SHA512 b6d4a924ef2fafaf68a2f0e6861f08da48cc8928b4ab5aef443f004680c8d740ff8280e253a5868f5dc54139d7267fd15d01723ea38388f299f61a9810d7ef3e
SSDEEP 98304:9L0dHS/XxnYk3bUlgY/xaIPopx/XA3LFpprO3w1N2n3/2+UMxzVX:aM3w1NK/SMxzV
TLSH
T166067C07F3A580E9D46AC478C20BA237FB72F8496635B69B17D45F262F63B602B1D314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2826008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

update.pdb

bcryptprimitives

ProcessPrng

kernel32

WriteFileEx SetHandleInformation CreateThread GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetFileInformationByHandleEx DeleteFileW CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle GetLastError WaitForMultipleObjects GetExitCodeProcess GetTempPathW CopyFileExW GetSystemInfo CreateWaitableTimerExW SetWaitableTimer SetFileInformationByHandle CloseHandle FindNextFileW GetDriveTypeW GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetDiskFreeSpaceExW DeviceIoControl PostQueuedCompletionStatus FindClose GetSystemTimePreciseAsFileTime FindFirstVolumeW LoadLibraryExA FindNextVolumeW FindVolumeClose ConnectNamedPipe LoadLibraryA GetTickCount CreateNamedPipeW WaitForSingleObjectEx GetCurrentProcess GetProcessId OpenThread GetCurrentThreadId PeekNamedPipe SleepEx ReadFile SetCurrentDirectoryW CreateToolhelp32Snapshot Thread32First GetThreadContext Thread32Next GetModuleHandleW WriteFile GetProcessHeap AddVectoredExceptionHandler HeapAlloc ReadFileEx lstrlenW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WideCharToMultiByte RtlVirtualUnwind MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal SetThreadStackGuarantee GetCurrentProcessId GetCurrentThread HeapReAlloc SwitchToThread SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection Sleep GetModuleHandleA GetProcAddress WriteConsoleW WaitForSingleObject InitializeSListHead GetFileInformationByHandle GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex HeapFree CreateMutexA SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSAIoctl bind ioctlsocket setsockopt connect closesocket getpeername WSAGetLastError getsockname getsockopt send recv freeaddrinfo getaddrinfo shutdown WSASocketW WSACleanup WSAStartup WSASend

ntdll

NtOpenFile NtWriteFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtReadFile

bcrypt

BCryptGenRandom

advapi32

RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegEnumValueW RegCloseKey RegSetValueExW SystemFunction036

crypt32

CertGetCertificateChain CertFreeCertificateContext CertDuplicateStore CertOpenStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertAddCertificateContextToStore CertCloseStore CertFreeCertificateChain CertEnumCertificatesInStore CertVerifyCertificateChainPolicy

secur32

DecryptMessage FreeContextBuffer EncryptMessage FreeCredentialsHandle ApplyControlToken InitializeSecurityContextW AcquireCredentialsHandleA DeleteSecurityContext AcceptSecurityContext QueryContextAttributesW

oleaut32

GetErrorInfo SysAllocStringLen SysStringLen SysFreeString SafeArrayDestroy VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoCreateInstance

vcruntime140

memmove __C_specific_handler strrchr strchr memchr __current_exception_context memcmp memcpy memset __CxxFrameHandler3 __current_exception

api-ms-win-crt-string-l1-1-0

strlen strcmp strcspn strncmp strspn

api-ms-win-crt-math-l1-1-0

_dclass pow __setusermatherr fabs log

api-ms-win-crt-heap-l1-1-0

free malloc _msize realloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_cexit _endthreadex _initialize_narrow_environment __p___argv _beginthreadex _c_exit terminate _seh_filter_exe _crt_atexit _get_initial_narrow_environment _initterm _register_onexit_function __p___argc _initialize_onexit_table _initterm_e exit _exit _set_app_type _register_thread_local_exe_atexit_callback _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_0f8e3672307d726baa7eb1dfdb8b3ecc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

crypt32

secur32

oleaut32

shell32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic