2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom
Size 25.2MB
Sample260819-e6vcjsdn6t
SHA256 cdb016bb6ed612e9c679057e1dafebed1494e50e1774c40f4f2745246444772d
MD5 bb6d053f6203307c6b88a2092fbab76b
SHA1 ceb5dba7cddf40322c44a3ffd5e4bec348c8763e
SHA512 c9fb85708b751198e473c1b55be1591accd72221f287d3d182b91865292a04d04a70ea57868f1ddfccb6520674dfecbf82f67d16c1c9b6ffda432a9146b3364d
SSDEEP 98304:7cuFLCGzwLFDI21crpkGnLIE1Q/QeY4QtJu0T93d2DtU+gjhNofrd8RwGMf:IwCGzwZZitLtQ/VctJuA3d2DS/jUt
TLSH
T19247B526F9198D62E289C539859A5343023470871E04BD7B378C891C1F9FFBF663B76A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

.exe 25.2MB

2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

IMPHASH ee623f1e4162ae9a3dd59200d1359275
SHA256 cdb016bb6ed612e9c679057e1dafebed1494e50e1774c40f4f2745246444772d
MD5 bb6d053f6203307c6b88a2092fbab76b
SHA1 ceb5dba7cddf40322c44a3ffd5e4bec348c8763e
SHA512 c9fb85708b751198e473c1b55be1591accd72221f287d3d182b91865292a04d04a70ea57868f1ddfccb6520674dfecbf82f67d16c1c9b6ffda432a9146b3364d
SSDEEP 98304:7cuFLCGzwLFDI21crpkGnLIE1Q/QeY4QtJu0T93d2DtU+gjhNofrd8RwGMf:IwCGzwZZitLtQ/VctJuA3d2DS/jUt
TLSH
T19247B526F9198D62E289C539859A5343023470871E04BD7B378C891C1F9FFBF663B76A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

04:26:f3:70:34:31:07:09:2e:33:c9:db:d1:b8:b7:ed:91:56:7e:15:05:3d:a4:fb:c3:b4:53:06:37:7c:79:b2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Aug 17, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

7a:08:df:7f:49:7c:5f:19:8d:3e:e0:ab

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 8, 2026 - Aug 10, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

8978976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

llmfit.pdb

kernel32

GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCtrlHandler Process32FirstW CreateToolhelp32Snapshot LocalFree Process32NextW CreateConsoleScreenBuffer ReadProcessMemory SetConsoleActiveScreenBuffer GetStdHandle CreateEventW GetSystemInfo SetConsoleCursorInfo SetConsoleCursorPosition HeapAlloc GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode RtlVirtualUnwind GetConsoleMode MultiByteToWideChar WideCharToMultiByte GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetOverlappedResult ReadFile SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation GetProcessIoCounters GetSystemTimes GlobalMemoryStatusEx K32GetPerformanceInfo GetCurrentProcessId WriteConsoleW VirtualQueryEx GetExitCodeProcess lstrlenW GetProcessTimes CreateFileW WaitForMultipleObjects FormatMessageW OpenProcess HeapFree GetCurrentThread GlobalFree GetSystemTimeAsFileTime GlobalUnlock GetProcessHeap GetFinalPathNameByHandleW SetLastError GlobalAlloc GlobalLock InitializeSListHead GetBinaryTypeW SetUnhandledExceptionFilter GetProcAddress GetModuleHandleA Sleep GetLastError CloseHandle CompareStringOrdinal FindNextFileW GetModuleHandleW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP ReadConsoleW GetModuleFileNameW DeleteFileW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx SwitchToThread ExitProcess FindClose FindFirstFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetEnvironmentStringsW TerminateProcess GetProcessId CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess ReadFileEx CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW GetCurrentThreadId GetFullPathNameW SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW

ws2_32

WSACleanup freeaddrinfo select WSAGetLastError socket WSAStartup WSAIoctl setsockopt getpeername getaddrinfo listen bind WSASocketW send recv getsockopt connect ioctlsocket WSASend accept shutdown closesocket

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

shell32

CommandLineToArgvW SHGetKnownFolderPath

advapi32

ImpersonateAnonymousToken RevertToSelf IsValidSid SystemFunction036 OpenProcessToken GetTokenInformation CopySid GetLengthSid

ntdll

RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile NtDeviceIoControlFile NtCreateFile NtQueryInformationProcess NtReadFile RtlGetVersion NtCancelIoFileEx NtOpenFile

combase

CoTaskMemFree

pdh

PdhOpenQueryW PdhEnumObjectsW PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhRemoveCounter

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo

psapi

GetModuleFileNameExW GetProcessMemoryInfo

bcryptprimitives

ProcessPrng

user32

RegisterClipboardFormatW CloseClipboard GetForegroundWindow GetWindowThreadProcessId GetKeyboardLayout ToUnicodeEx SetClipboardData OpenClipboard EmptyClipboard

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcmp memcpy memmove memset _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

ceil pow __setusermatherr round exp trunc

api-ms-win-crt-runtime-l1-1-0

strerror _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _cexit terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initterm_e _register_thread_local_exe_atexit_callback _c_exit exit __p___argv __p___argc _exit

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_bb6d053f6203307c6b88a2092fbab76b_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

shell32

advapi32

ntdll

combase

pdh

powrprof

oleaut32

psapi

bcryptprimitives

user32

bcrypt

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic