2026-08-21_540bde9f06c3323ec7a4005a29540169_akira_chir_cobalt-strike_glassworm_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_540bde9f06c3323ec7a4005a29540169_akira_chir_cobalt-strike_glassworm_satacom
Size 690KB
Sample260821-e7jmfashka
SHA256 19f6fce3d56e8fe22228938ba4e65de2ba8919d9071334974af24ae4d5bb3d81
MD5 540bde9f06c3323ec7a4005a29540169
SHA1 541170615318aa10fa8f708649f50a95f9b7c526
SHA512 d282a50f67e0d169283ea5c3a16453b161207a88db987239a56e7a2ba8fe4f957bf2b2152183af4cde70d1f10b6b96a7663832bac2d11f32d748dc0dd3495538
SSDEEP 12288:bqibs54Szsa1JHt6gLb5L2rn65hYHn6WiO7C+4Q+/:bqYsaW6ob9Qn652aO76/
TLSH
T1AAE46C07FBC15AA9C459D2794257A732B732BC480B22EBEB1380B7313D26AD15F39758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_540bde9f06c3323ec7a4005a29540169_akira_chir_cobalt-strike_glassworm_satacom

File Explorer

2026-08-21_540bde9f06c3323ec7a4005a29540169_akira_chir_cobalt-strike_glassworm_satacom

.exe 690KB

2026-08-21_540bde9f06c3323ec7a4005a29540169_akira_chir_cobalt-strike_glassworm_satacom

IMPHASH a70d0aa3a76fbd1ca9af17d4dc19e770
SHA256 19f6fce3d56e8fe22228938ba4e65de2ba8919d9071334974af24ae4d5bb3d81
MD5 540bde9f06c3323ec7a4005a29540169
SHA1 541170615318aa10fa8f708649f50a95f9b7c526
SHA512 d282a50f67e0d169283ea5c3a16453b161207a88db987239a56e7a2ba8fe4f957bf2b2152183af4cde70d1f10b6b96a7663832bac2d11f32d748dc0dd3495538
SSDEEP 12288:bqibs54Szsa1JHt6gLb5L2rn65hYHn6WiO7C+4Q+/:bqYsaW6ob9Qn652aO76/
TLSH
T1AAE46C07FBC15AA9C459D2794257A732B732BC480B22EBEB1380B7313D26AD15F39758
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1074417361

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\slimbrowser\git\115\release_x64\toolkit\mozapps\defaultagent\default-browser-agent.pdb

advapi32

ConvertSidToStringSidW DeregisterEventSource GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyValueW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryInfoKeyW RegSetKeyValueW RegSetValueExW RegisterEventSourceW ReportEventW SystemFunction036

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptHashData BCryptOpenAlgorithmProvider

crypt32

CryptBinaryToStringW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CompareStringOrdinal CreateEventW CreateMutexA CreateMutexW CreateProcessW DeleteCriticalSection EnterCriticalSection FileTimeToSystemTime FormatMessageW GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetUserDefaultLocaleName GetVersionExW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW lstrlenW

netapi32

NetApiBufferFree NetUserGetInfo

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

oleaut32

SysAllocString SysFreeString VariantClear

shell32

SHChangeNotify

shlwapi

AssocQueryStringW PathAppendW PathCombineW PathRemoveFileSpecW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fail@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

user32

CharLowerW

wininet

HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetOpenW InternetReadFile

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy _purecall memchr memcmp memcpy memmove memset wcschr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vswprintf _fseeki64 _get_stream_buffer_pointers _set_fmode _wfopen fclose fflush fgetc fgetpos fputc fread fseek fsetpos ftell fwrite setvbuf ungetc

api-ms-win-crt-math-l1-1-0

__setusermatherr _dtest ceilf

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_wcsnicmp strcmp strcpy strlen wcscat_s wcscmp wcscpy wcscpy_s wcslen wcspbrk

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-convert-l1-1-0

wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

398KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

157B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

16B

Characteristics

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

�h

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_540bde9f06c3323ec7a4005a29540169_akira_chir_cobalt-strike_glassworm_satacom

advapi32

bcrypt

crypt32

kernel32

netapi32

ole32

oleaut32

shell32

shlwapi

msvcp140

user32

wininet

ntdll

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic