2026-08-09_4cee887cb4aa11af11e39512e94259d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_4cee887cb4aa11af11e39512e94259d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 34.6MB
Sample260809-rssb9asxev
SHA256 80d3a239b3fe2b98d44f48c373b564f6a4df02c8cd8411f99feb9651a29e83cf
MD5 4cee887cb4aa11af11e39512e94259d2
SHA1 b80664334e4fe693fb8f19c5915d8f512225ff61
SHA512 5a8a4fb6932bdce0a2f70858998d79fbbc0ca51d9cb8adcbf6fd899c8767464e3e22672a45c48e42928ff1e0327ef7f500068d8d5148c8a02a201d6961cef5fa
SSDEEP 786432:3AejOurnlm713ERDfV1VBuS96jBG/9KXn:3zOcnlmNEHGgWn
TLSH
T15187F052F6A280F9C16AC035821A6633FB717C4947353AEB5BE44B243EA5FD0673EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_4cee887cb4aa11af11e39512e94259d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-09_4cee887cb4aa11af11e39512e94259d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 34.6MB

2026-08-09_4cee887cb4aa11af11e39512e94259d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH bfda8b0203203ece8395cba343cea7e5
SHA256 80d3a239b3fe2b98d44f48c373b564f6a4df02c8cd8411f99feb9651a29e83cf
MD5 4cee887cb4aa11af11e39512e94259d2
SHA1 b80664334e4fe693fb8f19c5915d8f512225ff61
SHA512 5a8a4fb6932bdce0a2f70858998d79fbbc0ca51d9cb8adcbf6fd899c8767464e3e22672a45c48e42928ff1e0327ef7f500068d8d5148c8a02a201d6961cef5fa
SSDEEP 786432:3AejOurnlm713ERDfV1VBuS96jBG/9KXn:3zOcnlmNEHGgWn
TLSH
T15187F052F6A280F9C16AC035821A6633FB717C4947353AEB5BE44B243EA5FD0673EB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8266328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

enoughvisuals_launcher.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx RtlGetVersion NtWriteFile NtCreateNamedPipeFile NtCreateFile RtlNtStatusToDosError NtOpenFile NtDeviceIoControlFile NtReadFile

kernel32

FlsGetValue FlsSetValue FlsAlloc FlsFree RaiseException RtlPcToFileHeader GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GetQueuedCompletionStatusEx GetProcessHeap EncodePointer GetModuleHandleA HeapFree SwitchToThread ReadFile GetCurrentThreadId GetModuleHandleW CreateThread Sleep LoadLibraryW WriteFile CreateFileW OpenEventW SetEvent SetFileAttributesW GlobalMemoryStatusEx GetOverlappedResult GetConsoleMode CreateEventW RemoveDllDirectory FreeLibrary AddDllDirectory LoadLibraryExW RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess CreateMutexA ReleaseMutex MultiByteToWideChar HeapAlloc SetThreadErrorMode SleepEx GetProcAddress SetHandleInformation GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW CopyFileExW FindNextFileW WideCharToMultiByte GetConsoleOutputCP SetFilePointerEx PostQueuedCompletionStatus GetACP GetCurrentProcessId GetSystemTimePreciseAsFileTime MoveFileExW K32EnumProcesses OpenProcess QueryFullProcessImageNameW LockFileEx lstrlenW WriteConsoleW WaitForSingleObject UnlockFile GetSystemFirmwareTable ReadFileEx LocalFree CloseHandle LoadLibraryA GetSystemInfo GetLastError WriteFileEx GetStdHandle CreateIoCompletionPort SetWaitableTimer LCIDToLocaleName HeapReAlloc CreateWaitableTimerExW GetUserDefaultUILanguage LoadLibraryExA WaitForMultipleObjects FormatMessageW GetCurrentThread InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue OutputDebugStringA OutputDebugStringW SetLastError SetFileCompletionNotificationModes FindClose FlushFileBuffers SetThreadStackGuarantee CancelIoEx InitializeSListHead InitializeCriticalSectionEx SetUnhandledExceptionFilter RtlUnwindEx SetCurrentDirectoryW DeleteCriticalSection SetEnvironmentVariableW AddVectoredExceptionHandler GetCommandLineW QueryPerformanceCounter QueryPerformanceFrequency FreeEnvironmentStringsW RtlCaptureContext GetEnvironmentStringsW GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

user32

CreateMenu CreatePopupMenu SetMenuItemInfoW CreateIcon InsertMenuW AppendMenuW GetDC ReleaseDC DrawIconEx RemoveMenu CreateAcceleratorTableW PostQuitMessage ShowWindow GetMenuBarInfo MapWindowPoints OffsetRect GetWindowDC DestroyMenu DrawMenuBar SetMenu DestroyAcceleratorTable EnumChildWindows GetMenuItemInfoW SystemParametersInfoA DispatchMessageA GetMessageA GetAsyncKeyState GetForegroundWindow DrawTextW TranslateAcceleratorW SetWindowDisplayAffinity SendInput SetForegroundWindow SetParent SetFocus RegisterTouchWindow IsWindow GetWindow AdjustWindowRectEx RegisterClassExW FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos SetWindowRgn GetWindowRect InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData SetCursor LoadCursorW GetParent CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FindWindowExW FillRect SetPropW GetSystemMetrics CheckMenuItem GetMonitorInfoW MonitorFromRect ClientToScreen GetWindowLongW ScreenToClient GetKeyboardState SetWindowTextW DefWindowProcW MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageW DispatchMessageW PostThreadMessageW GetWindowTextW GetWindowTextLengthW GetMenu ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout GetKeyState SetWindowLongW GetSystemMenu ClipCursor GetClipCursor IsWindowEnabled EnableWindow MonitorFromWindow IsIconic IsWindowVisible GetCursorPos SendMessageW GetClientRect ShowCursor PostMessageW RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint RegisterRawInputDevices RegisterWindowMessageA GetMessageW IsProcessDPIAware SetWindowLongPtrW CreateWindowExW TrackPopupMenu EnableMenuItem VkKeyScanW GetWindowLongPtrW DestroyIcon

oleaut32

SysFreeString SetErrorInfo GetErrorInfo SysStringLen

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

shell32

SHAppBarMessage SHCreateItemFromParsingName SHGetKnownFolderPath DragFinish ShellExecuteW DragQueryFileW

ole32

CoTaskMemAlloc CoCreateInstance RegisterDragDrop RevokeDragDrop CoTaskMemFree OleInitialize CoUninitialize CoCreateFreeThreadedMarshaler CoInitializeEx

gdi32

CreateRectRgn BitBlt CombineRgn DeleteObject CreateSolidBrush SelectObject GetDeviceCaps SetTextColor SetBkMode DeleteDC CreateCompatibleDC CreateDIBSection

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

crypt32

CryptUnprotectData CryptProtectData CertFreeCertificateChainEngine CertAddEncodedCertificateToStore CertFreeCertificateContext CertCreateCertificateChainEngine CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertSetCertificateContextProperty CertCloseStore

bcrypt

BCryptGenRandom

advapi32

RegCloseKey RegGetValueW RegQueryValueExW RegOpenKeyExW EventWriteTransfer EventSetInformation SystemFunction036 EventRegister EventUnregister

ws2_32

accept WSAGetLastError WSASend shutdown send recv freeaddrinfo getaddrinfo setsockopt WSACleanup WSAStartup WSASocketW ioctlsocket bind listen getpeername getsockname WSAIoctl getsockopt connect closesocket

api-ms-win-crt-math-l1-1-0

trunc roundf pow __setusermatherr floor round

api-ms-win-crt-string-l1-1-0

wcslen strcpy_s _wcsicmp wcscmp strcmp strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _crt_atexit terminate _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _errno _seh_filter_exe _set_app_type _wassert _configure_narrow_argv _initialize_narrow_environment abort _get_initial_narrow_environment _initterm

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol strtol _wtoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf fflush __acrt_iob_func __stdio_common_vsscanf __p__commode _set_fmode _setmode fwrite ftell fclose feof ferror fgets fopen _fileno fread fseek

api-ms-win-crt-heap-l1-1-0

calloc _callnewh realloc _set_new_mode malloc free

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

8.0MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26.4MB

Virtual Size

26.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.evsig

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_4cee887cb4aa11af11e39512e94259d2_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

user32

oleaut32

comctl32

shell32

ole32

gdi32

dwmapi

shlwapi

crypt32

bcrypt

advapi32

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic