2026-08-30_ca4ddedb0e5f642f45ba26a7f9b0d723_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_ca4ddedb0e5f642f45ba26a7f9b0d723_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 15.8MB
Sample260831-e4x1naef62
SHA256 c4c41d19aa15ecffb84077848e25ae86fb7c4676f929d1e1b62bd72f9780baa6
MD5 ca4ddedb0e5f642f45ba26a7f9b0d723
SHA1 14f91e1e749d01c8655a91796a6b593886f9380f
SHA512 f3528cf838b2d1bf765223148cebfb761cae7e75354f7b89a5bda3523c7d1668d148ed9644fa3630bb778778e543e967f98ab16848674f7fd6a51ff6e1eb0276
SSDEEP 98304:1ck9Eifxh+/chF3iqK+X2nXyHxf1ZTbPHH5tgpfum2Q96psJ1BJg2PV9zP+YiQcp:L7FhKU+O/LglumB96ABP/7f1
TLSH
T1C7F619117B9FA9ADD19AC874834A4AB35E2170DB1B26B8FF40C451393FADAB05B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_ca4ddedb0e5f642f45ba26a7f9b0d723_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-30_ca4ddedb0e5f642f45ba26a7f9b0d723_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 15.8MB

2026-08-30_ca4ddedb0e5f642f45ba26a7f9b0d723_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 643a21d916d57d72e2d4ec34baa68d31
SHA256 c4c41d19aa15ecffb84077848e25ae86fb7c4676f929d1e1b62bd72f9780baa6
MD5 ca4ddedb0e5f642f45ba26a7f9b0d723
SHA1 14f91e1e749d01c8655a91796a6b593886f9380f
SHA512 f3528cf838b2d1bf765223148cebfb761cae7e75354f7b89a5bda3523c7d1668d148ed9644fa3630bb778778e543e967f98ab16848674f7fd6a51ff6e1eb0276
SSDEEP 98304:1ck9Eifxh+/chF3iqK+X2nXyHxf1ZTbPHH5tgpfum2Q96psJ1BJg2PV9zP+YiQcp:L7FhKU+O/LglumB96ABP/7f1
TLSH
T1C7F619117B9FA9ADD19AC874834A4AB35E2170DB1B26B8FF40C451393FADAB05B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12638368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

onepipeline.pdb

kernel32

SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx CreateProcessW CreateDirectoryW SetThreadStackGuarantee GetCurrentThread RemoveDirectoryW CopyFileExW MoveFileExW FindFirstFileExW ExitProcess WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW ReadConsoleW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW GetCurrentProcess GetFileAttributesW GetFileType WaitForMultipleObjects GetTempPathW CancelIo FindNextFileW LocalFree SetHandleInformation GetOverlappedResult CreateFileW GetProcessHeap HeapFree HeapReAlloc Process32NextW GetSystemTimePreciseAsFileTime SetEnvironmentVariableW Process32FirstW SetFileInformationByHandle CreateEventW ReadFile ReadFileEx GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemInfo CompareStringOrdinal GetCurrentThreadId SetConsoleCtrlHandler QueryPerformanceFrequency QueryPerformanceCounter TerminateProcess GlobalFree GetBinaryTypeW SleepEx WriteFileEx QueryInformationJobObject SetInformationJobObject GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW AddVectoredExceptionHandler GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW WideCharToMultiByte LoadLibraryA CreateJobObjectW HeapAlloc GetModuleFileNameW MultiByteToWideChar GetModuleHandleW FormatMessageW OpenJobObjectW TerminateJobObject GetProcessTimes OpenProcess CreateThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GlobalAlloc GetExitCodeProcess WaitForSingleObject SetLastError ResumeThread OpenThread Thread32Next Thread32First CreateToolhelp32Snapshot GetProcessId AssignProcessToJobObject SwitchToThread FindClose GetCurrentProcessId GetSystemTimeAsFileTime UnlockFile LockFileEx GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode PeekNamedPipe GetStdHandle SetFilePointerEx DuplicateHandle InitializeSListHead GetProcAddress GetModuleHandleA Sleep CloseHandle SetWaitableTimer GetLastError SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateChain CertCloseStore CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CertSetCertificateContextProperty CertGetCertificateChain CertOpenStore CertAddEncodedCertificateToStore CertFreeCertificateContext

ntdll

RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

advapi32

SystemFunction036

ws2_32

getsockname WSACleanup getpeername WSASocketW select bind getsockopt ioctlsocket getaddrinfo listen send recv WSAGetLastError setsockopt closesocket WSAStartup freeaddrinfo connect

vcruntime140

memset __current_exception_context __current_exception memcpy __CxxFrameHandler3 memmove memcmp _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

pow __setusermatherr floor fmod ceil log2 trunc

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit __p___argc _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv _initterm _set_app_type _seh_filter_exe _initterm_e _c_exit exit _exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_ca4ddedb0e5f642f45ba26a7f9b0d723_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

crypt32

ntdll

advapi32

ws2_32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic