2026-09-04_adb97be54a5571e0bc7bd4dff8f3708f_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_adb97be54a5571e0bc7bd4dff8f3708f_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
Size 4.8MB
Sample260905-arpfjatbpc
SHA256 a46837cb050492d993ffa9f25bbcd23f8cccfd8e9b6293ebb0e6d2d7d1291d2e
MD5 adb97be54a5571e0bc7bd4dff8f3708f
SHA1 30cd54f76464ac4ea0a14c390633ed314444bb13
SHA512 581945f2c55ebe5c20ffa9cb5cbad4914a0c62762c696ac11234402e778fa6497fe0b359b65e7e6d0846714948fbca56c631002e37c422572e1cdd057687b770
SSDEEP 49152:ye3Mv15312HgPHwp4o4IK+WO31RmlkUOu0AhAFyrcCRH6zax5CEwfx08vvkhzJXE:Gvu7K/NRH4oePMb3m8/xG
TLSH
T149365C13BB6A99ADC89AC0B483668772597134CB0B3479FF408496387E69EF11F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_adb97be54a5571e0bc7bd4dff8f3708f_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

File Explorer

2026-09-04_adb97be54a5571e0bc7bd4dff8f3708f_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

.exe 4.8MB

2026-09-04_adb97be54a5571e0bc7bd4dff8f3708f_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

IMPHASH b3d36302abb058e4a4d8c6ea652f8bd9
SHA256 a46837cb050492d993ffa9f25bbcd23f8cccfd8e9b6293ebb0e6d2d7d1291d2e
MD5 adb97be54a5571e0bc7bd4dff8f3708f
SHA1 30cd54f76464ac4ea0a14c390633ed314444bb13
SHA512 581945f2c55ebe5c20ffa9cb5cbad4914a0c62762c696ac11234402e778fa6497fe0b359b65e7e6d0846714948fbca56c631002e37c422572e1cdd057687b770
SSDEEP 49152:ye3Mv15312HgPHwp4o4IK+WO31RmlkUOu0AhAFyrcCRH6zax5CEwfx08vvkhzJXE:Gvu7K/NRH4oePMb3m8/xG
TLSH
T149365C13BB6A99ADC89AC0B483668772597134CB0B3479FF408496387E69EF11F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3214428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

class_monitor.pdb

kernel32

GetFileInformationByHandle GetExitCodeProcess SetFileCompletionNotificationModes GetQueuedCompletionStatusEx GetCurrentProcessId Sleep GetModuleHandleA GetTimeZoneInformationForYear GetProcessIoCounters GetSystemTimes CreateIoCompletionPort UnhandledExceptionFilter OpenProcess lstrlenW GetSystemInfo ReadFile GetOverlappedResult PostQueuedCompletionStatus DuplicateHandle GetCurrentProcess VirtualQueryEx IsProcessorFeaturePresent GetSystemTimeAsFileTime FormatMessageW DeviceIoControl GlobalMemoryStatusEx GetVolumeInformationW GetDriveTypeW CreateFileW SetHandleInformation GetModuleHandleW HeapFree FreeLibrary GetProcAddress LoadLibraryExA GetLastError CreateEventW CloseHandle SetUnhandledExceptionFilter HeapAlloc GetProcessHeap InitializeSListHead ReleaseSemaphore GetConsoleMode GetProcessTimes GetTickCount64 GetLogicalDrives GetDiskFreeSpaceExW WaitForSingleObject FindNextFileW GetTempPathW ReadProcessMemory WaitForMultipleObjects SetConsoleCtrlHandler CreateSemaphoreA LocalFree CompareStringOrdinal GetModuleFileNameW FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetFileAttributesW ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW TerminateProcess GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetConsoleOutputCP WriteConsoleW CopyFileExW FindFirstFileExW FindClose SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW MultiByteToWideChar DeleteFileW ReadConsoleW IsDebuggerPresent

oleaut32

SysFreeString VariantClear SysStringLen GetErrorInfo SysAllocString

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

RegCloseKey RegEnumKeyExW RegQueryValueExW RegOpenKeyExW SystemFunction036 GetTokenInformation OpenProcessToken CopySid GetLengthSid IsValidSid LookupAccountSidW

secur32

QueryContextAttributesW LsaEnumerateLogonSessions LsaFreeReturnBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext FreeContextBuffer InitializeSecurityContextW LsaGetLogonSessionData AcquireCredentialsHandleA DecryptMessage EncryptMessage AcceptSecurityContext

bcrypt

BCryptGenRandom

ws2_32

ioctlsocket setsockopt getsockopt getpeername getsockname send WSASend recv bind shutdown WSAIoctl closesocket WSAGetLastError getaddrinfo WSAStartup WSACleanup WSASocketW connect freeaddrinfo

crypt32

CertCloseStore CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertOpenStore

ntdll

NtCreateFile NtDeviceIoControlFile NtQuerySystemInformation NtQueryInformationProcess RtlGetVersion NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile NtCancelIoFileEx NtReadFile NtOpenFile

bcryptprimitives

ProcessPrng

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket CoTaskMemFree

user32

EnumDisplayMonitors GetMonitorInfoW EnumDisplaySettingsExW

gdi32

GetDIBits StretchBlt SetStretchBltMode SelectObject DeleteDC CreateCompatibleDC CreateDCW GetObjectW GetDeviceCaps CreateCompatibleBitmap DeleteObject

pdh

PdhGetFormattedCounterValue PdhOpenQueryA PdhCollectQueryData PdhRemoveCounter PdhCloseQuery PdhAddEnglishCounterW

psapi

GetPerformanceInfo GetModuleFileNameExW

powrprof

CallNtPowerInformation

netapi32

NetApiBufferFree NetUserGetLocalGroups NetUserGetInfo NetUserEnum

iphlpapi

GetIfEntry2 FreeMibTable GetIfTable2 GetAdaptersAddresses

vcruntime140

memmove __current_exception_context __current_exception memcpy memcmp __CxxFrameHandler3 memset __C_specific_handler _CxxThrowException

api-ms-win-crt-math-l1-1-0

round cosf powf roundf fmod pow logf __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-heap-l1-1-0

free malloc realloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argv _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_adb97be54a5571e0bc7bd4dff8f3708f_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

kernel32

oleaut32

api-ms-win-core-synch-l1-2-0

advapi32

secur32

bcrypt

ws2_32

crypt32

ntdll

bcryptprimitives

shell32

ole32

user32

gdi32

pdh

psapi

powrprof

netapi32

iphlpapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic