2026-09-03_ec5f44cdb12d551428e602b1072987c7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-03_ec5f44cdb12d551428e602b1072987c7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 324KB
Sample260903-x8m1csvbra
SHA256 6f1b7d143d42b393b7b64c407f182f1f1f09d7ea1f359652451e330784aa96d2
MD5 ec5f44cdb12d551428e602b1072987c7
SHA1 74f8ba0967669e5b7418e17a4ffb4d28792d4d64
SHA512 19853710fc9d6b4eab79a0462bafc9150bc836318959d8fe07edd73a5b026bca812e2cb691adb659cb0d4f54b7e58c62bdbabb794af569ef0f98d0ca4f71b006
SSDEEP 6144:fuBdV6jvTQjqhEffq0h9VyLcNQgxhlcxWG:t51o7k
TLSH
T1FF645B12FA5658F8E05AC074835A8573AA767CCA0B21B9FF169466343F79EE12F3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-03_ec5f44cdb12d551428e602b1072987c7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 324KB

2026-09-03_ec5f44cdb12d551428e602b1072987c7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 2a5273e071a762d9498f1342837cfce1
SHA256 6f1b7d143d42b393b7b64c407f182f1f1f09d7ea1f359652451e330784aa96d2
MD5 ec5f44cdb12d551428e602b1072987c7
SHA1 74f8ba0967669e5b7418e17a4ffb4d28792d4d64
SHA512 19853710fc9d6b4eab79a0462bafc9150bc836318959d8fe07edd73a5b026bca812e2cb691adb659cb0d4f54b7e58c62bdbabb794af569ef0f98d0ca4f71b006
SSDEEP 6144:fuBdV6jvTQjqhEffq0h9VyLcNQgxhlcxWG:t51o7k
TLSH
T1FF645B12FA5658F8E05AC074835A8573AA767CCA0B21B9FF169466343F79EE12F3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

cc:4e:d0:ca:7b:37:78:bb:da:79:68:dd:2d:58:b7:71:6f:b5:7c:f5:21:6a:80:84:e5:af:ad:2b:5a:b5:f4:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Chains

Sep 1, 2026

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Serial Number

18:e3:9e:88:96:d2:39:fa:85:00:f1:72:0b:63:eb:ad

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 18, 2026 - Jun 18, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

236384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RedBooster_uninstaller.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

CreateFileW SetFileTime SetFileInformationByHandle GetSystemTimeAsFileTime CreateEventW CancelIo ReadFile RtlCaptureContext FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread QueryPerformanceCounter FindFirstFileExW GetModuleHandleA GetFileInformationByHandleEx FindNextFileW GetCurrentDirectoryW SetLastError GetCurrentThreadId HeapReAlloc GetCurrentThread FormatMessageW SetThreadStackGuarantee AddVectoredExceptionHandler FindClose GetExitCodeProcess WaitForSingleObject GetLastError GetOverlappedResult WaitForMultipleObjects CloseHandle HeapFree GetModuleHandleW WriteFileEx GetProcessHeap SleepEx ReadFileEx GetEnvironmentVariableW HeapAlloc WriteConsoleW MultiByteToWideChar InitializeSListHead SetUnhandledExceptionFilter GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte GetCommandLineW GetFullPathNameW ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetFileInformationByHandle GetCurrentProcess GetEnvironmentStringsW

advapi32

RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW

ntdll

NtOpenFile NtReadFile RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile

vcruntime140

__C_specific_handler memcmp memcpy __current_exception __current_exception_context __CxxFrameHandler3 memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argv terminate _crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _cexit _initialize_narrow_environment __p___argc _set_app_type _exit exit _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_ec5f44cdb12d551428e602b1072987c7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic