2026-09-12_b5ae1b5c4d1e8301113bc1211459dfb4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-12_b5ae1b5c4d1e8301113bc1211459dfb4_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 9.8MB
Sample260912-xtbzjsvxgx
SHA256 0923e5b373d8105dcd1821bd46e6a6a82580a5648f4b78a272b1678f122094dd
MD5 b5ae1b5c4d1e8301113bc1211459dfb4
SHA1 a3a3db1d04545a22815226c2cbd91400690556a7
SHA512 fbae54807b5ebc865992dea58f7726e3100dfec282e00c5d6870b914c44de11f3250b34a409785587ba4a0eccf26abdb50df0a113b4c6b2081e3ebffe2aa3635
SSDEEP 98304:voCkphTyc4KqTG91bETH76VMMTc7pOWOn+AGjWM0mM9lt:BQPqTK1oT+VfQdOW0faWXmMXt
TLSH
T17BA607026F8E59E9D19DCC74C38B8BA74E1230DB1A3AF9AF45C602152F6D6B55F2C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-12_b5ae1b5c4d1e8301113bc1211459dfb4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-12_b5ae1b5c4d1e8301113bc1211459dfb4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 9.8MB

2026-09-12_b5ae1b5c4d1e8301113bc1211459dfb4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH c6f71bf7f60a4ad53c1c275de3a4b602
SHA256 0923e5b373d8105dcd1821bd46e6a6a82580a5648f4b78a272b1678f122094dd
MD5 b5ae1b5c4d1e8301113bc1211459dfb4
SHA1 a3a3db1d04545a22815226c2cbd91400690556a7
SHA512 fbae54807b5ebc865992dea58f7726e3100dfec282e00c5d6870b914c44de11f3250b34a409785587ba4a0eccf26abdb50df0a113b4c6b2081e3ebffe2aa3635
SSDEEP 98304:voCkphTyc4KqTG91bETH76VMMTc7pOWOn+AGjWM0mM9lt:BQPqTK1oT+VfQdOW0faWXmMXt
TLSH
T17BA607026F8E59E9D19DCC74C38B8BA74E1230DB1A3AF9AF45C602152F6D6B55F2C318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6753056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cs_template.pdb

kernel32

GetStdHandle SetConsoleMode SetConsoleCursorPosition GetFileAttributesW CreateFileW LoadLibraryExA FormatMessageW lstrlenW FillConsoleOutputAttribute SwitchToThread CompareStringOrdinal GetCurrentProcess GetSystemInfo CreateWaitableTimerExW SetWaitableTimer FindNextFileW CancelIo FillConsoleOutputCharacterA GetCurrentThreadId WaitForSingleObjectEx GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex GetConsoleOutputCP ReadFileEx MultiByteToWideChar WriteConsoleW WriteFileEx CreateDirectoryW GetFileType GetConsoleMode CreateSymbolicLinkW MoveFileExW CreateHardLinkW GetCurrentThread SleepEx GetSystemTimePreciseAsFileTime ExitProcess GetSystemDirectoryW GetWindowsDirectoryW WaitForMultipleObjects GetExitCodeProcess SetFileAttributesW GetFinalPathNameByHandleW DeleteFileW RemoveDirectoryW SetHandleInformation GetTempPathW SetFilePointerEx GetConsoleScreenBufferInfo CloseHandle UnmapViewOfFile MapViewOfFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind LoadLibraryA SetFileTime FlushFileBuffers GetFileInformationByHandle SetFileInformationByHandle FindFirstFileExW GetFullPathNameW SetLastError GetVolumeNameForVolumeMountPointW DeviceIoControl GetVolumeInformationW GetVolumePathNameW CopyFileExW CancelIoEx SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetSystemTimeAsFileTime ReadFile PostQueuedCompletionStatus WriteFile DuplicateHandle SetConsoleTextAttribute GetFileInformationByHandleEx UnlockFile FindClose GetOverlappedResult LockFileEx SetThreadStackGuarantee GetProcAddress GetModuleHandleA Sleep GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject CreateEventW CreateThread CreateProcessW SetUnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler HeapReAlloc CreateFileMappingW VirtualProtect InitializeSListHead GetCurrentDirectoryW GetEnvironmentVariableW GetModuleHandleW GetModuleFileNameW GetCommandLineW QueryPerformanceFrequency QueryPerformanceCounter

advapi32

RegDeleteTreeW RegDeleteValueW RegCloseKey RegCreateKeyExW RegQueryValueExW SystemFunction036

shell32

SHChangeNotify SHGetKnownFolderPath

combase

CoTaskMemFree

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile NtReadFile NtCancelIoFileEx NtOpenFile NtCreateFile

oleaut32

SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSASocketW connect closesocket WSAIoctl getsockopt setsockopt WSAStartup getsockname WSAGetLastError getpeername WSACleanup getaddrinfo ioctlsocket freeaddrinfo send shutdown WSASend recv bind

crypt32

CertGetCertificateChain CertAddEncodedCertificateToStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertSetCertificateContextProperty CertCreateCertificateChainEngine CertFreeCertificateContext CertFreeCertificateChainEngine CertCloseStore

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler _CxxThrowException memset memcmp memmove memcpy __CxxFrameHandler3 __current_exception_context __current_exception

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

trunc __setusermatherr round pow truncf

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc _initterm_e _initterm _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe _configure_narrow_argv exit _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

369KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cscap

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cship

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-12_b5ae1b5c4d1e8301113bc1211459dfb4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

shell32

combase

ntdll

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic