2026-08-27_18f9b3ac12df330f5a4101ffb261f2b4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_18f9b3ac12df330f5a4101ffb261f2b4_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 4.8MB
Sample260827-11ekss1dkh
SHA256 04280ebbbc5f9f8c4fd78af39daed9f7323c85621261d6ee1f35193aca4fd447
MD5 18f9b3ac12df330f5a4101ffb261f2b4
SHA1 cc97f5d23ec05e8a31fa1a2b2733362c97f034f1
SHA512 67574508c371dcd0ce04d8529c35031d75bae8d5f8f81e9d8bac10d4fd434fe45fb9b732be3d0aba54bf4b1fa148a3b0553ae439b611bc1e07f14e5e24956bc3
SSDEEP 49152:QobKSU9lXEI6ujrphWx1HLhz9EHRNv4xu0PxOdCbs6qkeGl0EYae+rdk87v8GWE9:DTIeKeleoWrl+55Dd
TLSH
T16C361922AB6A99ACC49AC0B483964B72597134CB0F35B9FF40C452387F69AF51F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_18f9b3ac12df330f5a4101ffb261f2b4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-27_18f9b3ac12df330f5a4101ffb261f2b4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 4.8MB

2026-08-27_18f9b3ac12df330f5a4101ffb261f2b4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d8aa08f76d6e360e2f56eeb97118a234
SHA256 04280ebbbc5f9f8c4fd78af39daed9f7323c85621261d6ee1f35193aca4fd447
MD5 18f9b3ac12df330f5a4101ffb261f2b4
SHA1 cc97f5d23ec05e8a31fa1a2b2733362c97f034f1
SHA512 67574508c371dcd0ce04d8529c35031d75bae8d5f8f81e9d8bac10d4fd434fe45fb9b732be3d0aba54bf4b1fa148a3b0553ae439b611bc1e07f14e5e24956bc3
SSDEEP 49152:QobKSU9lXEI6ujrphWx1HLhz9EHRNv4xu0PxOdCbs6qkeGl0EYae+rdk87v8GWE9:DTIeKeleoWrl+55Dd
TLSH
T16C361922AB6A99ACC49AC0B483964B72597134CB0F35B9FF40C452387F69AF51F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3214560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

emi_client.pdb

kernel32

DuplicateHandle GetCurrentProcess UnregisterWaitEx GetCurrentThreadId OpenProcess GetProcessIoCounters GetSystemTimes GetExitCodeProcess CreateIoCompletionPort SetFileCompletionNotificationModes GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile CancelIoEx GetQueuedCompletionStatusEx GetProcessTimes GetSystemInfo VirtualQueryEx GlobalMemoryStatusEx Sleep GetModuleHandleA GetCurrentProcessId GetComputerNameExW GetModuleHandleW LocalFree SetNamedPipeHandleState CreateFileW FreeLibrary GetProcAddress WaitForSingleObject CreateEventW CreateMutexW GetConsoleWindow FormatMessageW LoadLibraryExA GetLastError GetSystemTimeAsFileTime SetHandleInformation K32GetPerformanceInfo SetUnhandledExceptionFilter FindNextFileW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TerminateProcess QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal GetFileAttributesW FreeEnvironmentStringsW CreateThread InitializeSListHead HeapFree HeapAlloc GetConsoleOutputCP GetProcessHeap CloseHandle GetStdHandle WriteConsoleW MultiByteToWideChar ReadProcessMemory CancelIo QueryPerformanceFrequency SleepEx ReadFileEx WaitForMultipleObjects ExitProcess GetModuleFileNameW GetTempPathW GetFullPathNameW HeapReAlloc lstrlenW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle GetConsoleMode AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW FindClose FindFirstFileExW GetFinalPathNameByHandleW MoveFileExW CreateDirectoryW GetFileInformationByHandleEx DeleteFileW SwitchToThread GetFileInformationByHandle

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyTransactedW RegCreateKeyTransactedW GetUserNameW GetTokenInformation RegSetValueExW OpenProcessToken RegCreateKeyExW RegDeleteValueW RegOpenKeyExW IsValidSid SystemFunction036 GetLengthSid CopySid

oleaut32

SysStringLen SysFreeString GetErrorInfo

ws2_32

getsockopt getpeername WSASend send setsockopt ioctlsocket connect WSAIoctl WSASocketW bind shutdown closesocket WSAGetLastError getsockname WSAStartup WSACleanup recv getaddrinfo freeaddrinfo

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

secur32

EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext FreeContextBuffer ApplyControlToken InitializeSecurityContextW AcceptSecurityContext DecryptMessage

crypt32

CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertFreeCertificateChain CertDuplicateCertificateChain CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertCloseStore

user32

ToUnicodeEx CallNextHookEx GetKeyboardLayout GetKeyboardState SetWindowsHookExA GetWindowThreadProcessId GetKeyState GetForegroundWindow ShowWindow GetMessageA GetMonitorInfoW MonitorFromPoint EnumDisplayMonitors EnumDisplaySettingsExW AttachThreadInput

bcrypt

BCryptGenRandom

ntdll

NtCreateNamedPipeFile RtlGetVersion NtCancelIoFileEx NtDeviceIoControlFile RtlNtStatusToDosError NtWriteFile NtQuerySystemInformation NtCreateFile NtReadFile NtOpenFile NtQueryInformationProcess

bcryptprimitives

ProcessPrng

gdi32

DeleteObject CreateDCW CreateCompatibleDC CreateCompatibleBitmap SelectObject SetStretchBltMode StretchBlt GetDeviceCaps DeleteDC GetDIBits GetObjectW

pdh

PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCollectQueryData PdhRemoveCounter PdhCloseQuery PdhOpenQueryA

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

vcruntime140

memcpy __current_exception_context __current_exception __CxxFrameHandler3 memmove __C_specific_handler _CxxThrowException memcmp memset

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr powf pow round cosf logf

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-runtime-l1-1-0

__p___argc _initialize_onexit_table _initterm_e exit _seh_filter_exe terminate _set_app_type _configure_narrow_argv _initialize_narrow_environment __p___argv _exit _register_thread_local_exe_atexit_callback _register_onexit_function _get_initial_narrow_environment _initterm _c_exit _crt_atexit _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_18f9b3ac12df330f5a4101ffb261f2b4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

oleaut32

ws2_32

api-ms-win-core-synch-l1-2-0

secur32

crypt32

user32

bcrypt

ntdll

bcryptprimitives

gdi32

pdh

powrprof

psapi

shell32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic