2026-08-10_dd8faa4fb8feb7956a8cd7b822d813df_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_dd8faa4fb8feb7956a8cd7b822d813df_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 18.2MB
Sample260810-ef1fwavvbv
SHA256 d6e9801f2632121af3ede053c8316c7ee5716f8244eafffc676e9988b2697865
MD5 dd8faa4fb8feb7956a8cd7b822d813df
SHA1 6fde3f7d3e05e38e0f6ecc13afde5facc0330792
SHA512 c1fbc5f4162f8732deae07a22d886e511319a6ce220f2e9d5ae70819e552c166cbacb9d97972905085bf20e2bf525aaadb01b7c7a68086578aa9f467bd106b56
SSDEEP 196608:TaABDTi7huyeFndDUUTOxiNGwuzb38FAGN09gi9x:TaABDTi7huyeFnd86Gwuz2AGm9tx
TLSH
T18A17F7217B5A99ACD09BC47483468AB21A3130DB1B35B9FF4484963C3F79BF56F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_dd8faa4fb8feb7956a8cd7b822d813df_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-10_dd8faa4fb8feb7956a8cd7b822d813df_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 18.2MB

2026-08-10_dd8faa4fb8feb7956a8cd7b822d813df_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 067afc5cb3d2adc6e5e0895485e1b481
SHA256 d6e9801f2632121af3ede053c8316c7ee5716f8244eafffc676e9988b2697865
MD5 dd8faa4fb8feb7956a8cd7b822d813df
SHA1 6fde3f7d3e05e38e0f6ecc13afde5facc0330792
SHA512 c1fbc5f4162f8732deae07a22d886e511319a6ce220f2e9d5ae70819e552c166cbacb9d97972905085bf20e2bf525aaadb01b7c7a68086578aa9f467bd106b56
SSDEEP 196608:TaABDTi7huyeFndDUUTOxiNGwuzb38FAGN09gi9x:TaABDTi7huyeFnd86Gwuz2AGm9tx
TLSH
T18A17F7217B5A99ACD09BC47483468AB21A3130DB1B35B9FF4484963C3F79BF56F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12468320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

prowler.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx NtCreateNamedPipeFile NtOpenFile NtWriteFile NtQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation NtReadFile NtDeviceIoControlFile RtlGetVersion NtCreateFile

advapi32

EventSetInformation SystemFunction036 CopySid EventRegister GetLengthSid RegCloseKey RegQueryValueExW RegOpenKeyExW EventWriteTransfer IsValidSid RegGetValueW EventUnregister OpenProcessToken GetTokenInformation

kernel32

lstrlenW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetOverlappedResult WriteFile CloseHandle GetLastError GetProcAddress Sleep ReadFile WakeAllConditionVariable LoadLibraryW GetModuleHandleA PostQueuedCompletionStatus LocalFree CancelIoEx SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException GetQueuedCompletionStatusEx GetModuleHandleW GetUserDefaultUILanguage LCIDToLocaleName FlsAlloc FlsGetValue GetFileInformationByHandle GetConsoleMode LoadLibraryA FindNextFileW GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW FlsSetValue FlsFree EncodePointer MultiByteToWideChar SetEnvironmentVariableW DeleteFileW CreateSymbolicLinkW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW InitializeSListHead SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW TerminateProcess GetProcessId CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx CancelIo SetUnhandledExceptionFilter GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx ReadFileEx GetCurrentProcess DuplicateHandle SetHandleInformation WaitForSingleObject SetFileCompletionNotificationModes GetCurrentThreadId GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW CreateThread QueryPerformanceCounter K32GetPerformanceInfo QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle CreateIoCompletionPort SetLastError FreeLibrary SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal CreatePipe CreateFileW SetNamedPipeHandleState GetEnvironmentVariableW ReadProcessMemory HeapAlloc GetProcessIoCounters GetSystemTimes GetExitCodeProcess CreateEventW OpenProcess VirtualQueryEx GetProcessHeap GetProcessTimes HeapFree RtlVirtualUnwind DeviceIoControl InitializeCriticalSectionEx GetSystemInfo GetCurrentProcessId GlobalMemoryStatusEx GetFullPathNameW GetCurrentThread LoadLibraryExA FormatMessageW DeleteCriticalSection

user32

FindWindowExW SetCursorPos IsWindowEnabled SetWindowRgn EnableWindow IsProcessDPIAware VkKeyScanW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx GetMenuItemInfoW SetTimer InvalidateRect UpdateWindow ChangeWindowMessageFilterEx RegisterClassW GetDC DestroyWindow CreateIcon GetKeyboardLayout ToUnicodeEx SetWindowLongW EnableMenuItem GetSystemMenu SendInput SetForegroundWindow GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible EnumDisplayMonitors TranslateAcceleratorW SetWindowTextW GetWindowTextW GetWindowTextLengthW MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SetWindowDisplayAffinity ReleaseDC RedrawWindow GetRawInputData ValidateRect SystemParametersInfoA SetPropW DestroyIcon GetActiveWindow GetForegroundWindow ReleaseCapture SetWindowLongPtrW SetCapture PostThreadMessageW MsgWaitForMultipleObjectsEx FlashWindowEx InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetWindowRect DefWindowProcW MapVirtualKeyW GetMessageW GetParent RegisterRawInputDevices KillTimer GetWindowLongPtrW RegisterTouchWindow IsWindow AdjustWindowRectEx IsIconic EnumChildWindows RegisterWindowMessageA GetWindow DispatchMessageA GetMessageA CreateWindowExW RegisterClassExW SetParent MapWindowPoints AdjustWindowRect SetWindowPos PostMessageW SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW SetFocus FillRect ShowWindow GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient TrackPopupMenu LoadCursorW SendMessageW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW MonitorFromPoint

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

ole32

CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoUninitialize RegisterDragDrop OleInitialize CoInitializeEx RevokeDragDrop CoInitialize CoCreateFreeThreadedMarshaler

gdi32

CombineRgn SetTextColor SetBkMode BitBlt GetDeviceCaps CreateCompatibleDC DeleteDC CreateDIBSection SelectObject CreateRectRgn DeleteObject CreateSolidBrush

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath Shell_NotifyIconW DragFinish Shell_NotifyIconGetRect ShellExecuteExW SHOpenFolderAndSelectItems CommandLineToArgvW ILCreateFromPathW ILFree ShellExecuteW SHAppBarMessage DragQueryFileW

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

ws2_32

WSAIoctl WSAStartup WSACleanup getaddrinfo closesocket getpeername getsockname getsockopt freeaddrinfo WSASend ioctlsocket connect recv send WSAGetLastError WSASocketW bind shutdown setsockopt

crypt32

CertDuplicateStore CertAddCertificateContextToStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertFreeCertificateContext CertFreeCertificateChain CertAddEncodedCertificateToStore CertOpenStore CertCloseStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertVerifyCertificateChainPolicy CertGetCertificateChain CryptUnprotectData CryptProtectData CertEnumCertificatesInStore CertSetCertificateContextProperty

secur32

InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage QueryContextAttributesW DeleteSecurityContext AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage

bcrypt

BCryptGenRandom

pdh

PdhCollectQueryData PdhOpenQueryA PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

floor round roundf __setusermatherr trunc pow

api-ms-win-crt-string-l1-1-0

wcscmp wcslen strcpy_s _wcsicmp

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initterm _seh_filter_exe _set_app_type _crt_atexit _exit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback __p___argc abort _initialize_onexit_table _register_onexit_function terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_dd8faa4fb8feb7956a8cd7b822d813df_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

ntdll

advapi32

kernel32

user32

api-ms-win-core-synch-l1-2-0

comctl32

ole32

gdi32

dwmapi

shlwapi

shell32

oleaut32

ws2_32

crypt32

secur32

bcrypt

pdh

powrprof

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic