2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

General

Target
2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 4.2MB
Sample260815-cdnceswhpg
SHA256 fae1a9aa44c1ce223d6d5811646db4b25763a6a2f860d30d77f12e73f0b1935f
MD5 0a020eafe2fcc18d0d0540dc376180f5
SHA1 f48b8f690a3eba83a8bae7bc8de97554fcd26960
SHA512 3abd520ed8ba8936488d757f540ddf9e90caf2f272d13da4bd6700dc7ef4ae058986d3772e3262abce622ae49041414c52606f04c1ae31b1da9b4aa6db693cf3
SSDEEP 49152:7p8SKq9QLJTb/MTAAojBgbNAbXxOvSzOhrqOliujlsEsqqWegh4pw5JX9+dcIvyy:F8g9qAi+fqWn9LIKcIKJT+oBB
TLSH
T1EF2629117B8A94ADC06AC474834A46729A3134CB1B35B9FF45C892793FBAAF45F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 4.2MB

2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH dde260cc27f1a24878ee75a1637dbf8e
SHA256 fae1a9aa44c1ce223d6d5811646db4b25763a6a2f860d30d77f12e73f0b1935f
MD5 0a020eafe2fcc18d0d0540dc376180f5
SHA1 f48b8f690a3eba83a8bae7bc8de97554fcd26960
SHA512 3abd520ed8ba8936488d757f540ddf9e90caf2f272d13da4bd6700dc7ef4ae058986d3772e3262abce622ae49041414c52606f04c1ae31b1da9b4aa6db693cf3
SSDEEP 49152:7p8SKq9QLJTb/MTAAojBgbNAbXxOvSzOhrqOliujlsEsqqWegh4pw5JX9+dcIvyy:F8g9qAi+fqWn9LIKcIKJT+oBB
TLSH
T1EF2629117B8A94ADC06AC474834A46729A3134CB1B35B9FF45C892793FBAAF45F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

237600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

twetz_installer.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

HeapSize LCMapStringW CompareStringW CloseHandle CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileType GetModuleHandleW FormatMessageW WaitForMultipleObjects GetModuleHandleA FindNextFileW LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW FreeLibrary WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter

ntdll

NtWriteFile NtReadFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile

Name

.text

Size

292KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_0a020eafe2fcc18d0d0540dc376180f5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic