2026-08-19_c4f0b9984f924626e009d9cf8427f8d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_c4f0b9984f924626e009d9cf8427f8d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 18.3MB
Sample260819-e2qhssytgs
SHA256 d3eb384325c3344d2d873cf03f47bba06ba4f2db445131aa155eeedc637a9371
MD5 c4f0b9984f924626e009d9cf8427f8d4
SHA1 95c1132c656688086dab3e94233b4405f63b4604
SHA512 0391dba958ea7290014f766e8bc411a1609a6400467abfacd4465d601c37b8522d548787c5eb8057a1a24851f91b13f65a8bbb5d5576408afe8fdf035eb8f2a1
SSDEEP 98304:r9g97neKL24JjPkYJK7CVRiC7vPhXsQPOyuzoo6Fl98Daz9g61IvH3+HoYxQKQz3:5gpno4J5JK7CbrPhXK
TLSH
T13C17B82966BC909ED677C0B892828F512E2170DA0B392FF740D582BA2F35DF95D3C764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_c4f0b9984f924626e009d9cf8427f8d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-19_c4f0b9984f924626e009d9cf8427f8d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 18.3MB

2026-08-19_c4f0b9984f924626e009d9cf8427f8d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d3e981df5dad3a903110d8e014477a68
SHA256 d3eb384325c3344d2d873cf03f47bba06ba4f2db445131aa155eeedc637a9371
MD5 c4f0b9984f924626e009d9cf8427f8d4
SHA1 95c1132c656688086dab3e94233b4405f63b4604
SHA512 0391dba958ea7290014f766e8bc411a1609a6400467abfacd4465d601c37b8522d548787c5eb8057a1a24851f91b13f65a8bbb5d5576408afe8fdf035eb8f2a1
SSDEEP 98304:r9g97neKL24JjPkYJK7CVRiC7vPhXsQPOyuzoo6Fl98Daz9g61IvH3+HoYxQKQz3:5gpno4J5JK7CbrPhXK
TLSH
T13C17B82966BC909ED677C0B892828F512E2170DA0B392FF740D582BA2F35DF95D3C764
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14161280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

policy_build_spec_v2_contract-2a6582f832028695.pdb

bcryptprimitives

ProcessPrng

kernel32

MoveFileExW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle CloseHandle InitializeSListHead GetSystemTimeAsFileTime GetTempPathW GetModuleHandleA WaitForMultipleObjects FormatMessageW GetModuleHandleW GetFileType GetFileAttributesW SetUnhandledExceptionFilter GetConsoleOutputCP GetConsoleMode CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtWriteFile

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memcmp memmove memset memcpy __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

floor fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table __p___argc _crt_atexit __p___argv _cexit _initterm_e _c_exit _exit _seh_filter_exe _set_app_type _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_c4f0b9984f924626e009d9cf8427f8d4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic