2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom
Size 18.3MB
Sample260827-lrbefssepe
SHA256 d3e95a06d3b586dc757fd613e07048f429668c3d29769e62acc1d7d1b9fb99d2
MD5 ba572296d042e9342494032337bb9bbd
SHA1 907c15ad408d83367f0b3983796aab1684563128
SHA512 79c90de9d185a5b8cff7af10acfb159f2ef479f173d555f58701646f60f43d4af07fea4947e3092703ee5ee1e1442b6e4e388db7aa50de1410e09415fc5f579e
SSDEEP 98304:UC+joaAr6a/m2LK7VWYyVxlGRx5hjRKVvz+KDFf356qbtJ/eFbqaJXM/6T7Xcd:bjlGLRYFpgrJXM/
TLSH
T1E7172922BB5A59ECC49AC474834646726A3134DF0B35BAFF44C496383F69AF52E3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

File Explorer

2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

.exe 18.3MB

2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

IMPHASH 60f7fb487c32a28323e731e25c996be1
SHA256 d3e95a06d3b586dc757fd613e07048f429668c3d29769e62acc1d7d1b9fb99d2
MD5 ba572296d042e9342494032337bb9bbd
SHA1 907c15ad408d83367f0b3983796aab1684563128
SHA512 79c90de9d185a5b8cff7af10acfb159f2ef479f173d555f58701646f60f43d4af07fea4947e3092703ee5ee1e1442b6e4e388db7aa50de1410e09415fc5f579e
SSDEEP 98304:UC+joaAr6a/m2LK7VWYyVxlGRx5hjRKVvz+KDFf356qbtJ/eFbqaJXM/6T7Xcd:bjlGLRYFpgrJXM/
TLSH
T1E7172922BB5A59ECC49AC474834646726A3134DF0B35BAFF44C496383F69AF52E3C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1837792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

YZXRT_Setup.pdb

kernel32

DuplicateHandle GetCurrentProcess SetHandleInformation GetProcAddress GetModuleHandleW SetNamedPipeHandleState CreateFileW FormatMessageW ReadFile GetOverlappedResult WriteFile PostQueuedCompletionStatus CreateIoCompletionPort CancelIoEx GetLastError HeapAlloc GetSystemTimeAsFileTime SetFileCompletionNotificationModes GetQueuedCompletionStatusEx HeapFree Sleep GetModuleHandleA GetProcessHeap CloseHandle InitializeSListHead WaitForMultipleObjects CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW SetWaitableTimer GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW CreateWaitableTimerExW GetCurrentProcessId ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetConsoleOutputCP CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW GetConsoleMode lstrlenW WriteConsoleW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW MultiByteToWideChar GetModuleFileNameW SetUnhandledExceptionFilter

advapi32

RegQueryValueExW RegOpenKeyExW RegOpenKeyTransactedW RegCloseKey RegCreateKeyExW RegCreateKeyTransactedW

ws2_32

ioctlsocket WSASend recv getsockopt getsockname getpeername WSAStartup send WSASocketW bind shutdown setsockopt closesocket WSAIoctl WSACleanup freeaddrinfo WSAGetLastError connect getaddrinfo

secur32

FreeCredentialsHandle QueryContextAttributesW AcquireCredentialsHandleA ApplyControlToken AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer EncryptMessage DecryptMessage DeleteSecurityContext

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

crypt32

CertEnumCertificatesInStore CertDuplicateStore CertFreeCertificateContext CertCloseStore CertAddCertificateContextToStore CertOpenStore CertFreeCertificateChain CertDuplicateCertificateContext CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain

ntdll

NtOpenFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile NtReadFile NtCreateNamedPipeFile

bcryptprimitives

ProcessPrng

shell32

ShellExecuteExW IsUserAnAdmin

vcruntime140

__current_exception __C_specific_handler __current_exception_context memset memcmp memmove __CxxFrameHandler3 memcpy _CxxThrowException

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _get_initial_narrow_environment _initialize_narrow_environment _initterm _initterm_e exit _register_onexit_function _exit _register_thread_local_exe_atexit_callback _c_exit _crt_atexit __p___argc __p___argv _cexit _configure_narrow_argv _set_app_type _seh_filter_exe terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_ba572296d042e9342494032337bb9bbd_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

kernel32

advapi32

ws2_32

secur32

api-ms-win-core-synch-l1-2-0

crypt32

ntdll

bcryptprimitives

shell32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic