2026-09-13_510df1f1b7cf8bc498a61f32cd04b0c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-13_510df1f1b7cf8bc498a61f32cd04b0c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 2.0MB
Sample260913-sqrtdayejc
SHA256 31c2411cc5114fcc89a33c9786fc07b9de5f08c1919d5942615ac436649acdb2
MD5 510df1f1b7cf8bc498a61f32cd04b0c6
SHA1 1f561e6e76e70165872130eae3bed408cc08b06c
SHA512 67acd2bf02e1976ca7be94fcf431277fe141a6c7b9531e7233903515b701384d73d3296443a86010869fd2c5ceec0e622993f6a23735523132b266b3c3a87282
SSDEEP 24576:ItZ1I+cT9bRQfFWRlT0L7p+kkvbCB0qcA6v2xLAS3lFfXiAHzFZgMMv:ItZyFyp+7Y76v4LPXiGvM
TLSH
T153957B43F66694F9D56AC07887466233BA32B88E07317AFB66D447343E26FD02A3C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-13_510df1f1b7cf8bc498a61f32cd04b0c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-09-13_510df1f1b7cf8bc498a61f32cd04b0c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 2.0MB

2026-09-13_510df1f1b7cf8bc498a61f32cd04b0c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH 9d86babeb7454719b30082eccc9146f1
SHA256 31c2411cc5114fcc89a33c9786fc07b9de5f08c1919d5942615ac436649acdb2
MD5 510df1f1b7cf8bc498a61f32cd04b0c6
SHA1 1f561e6e76e70165872130eae3bed408cc08b06c
SHA512 67acd2bf02e1976ca7be94fcf431277fe141a6c7b9531e7233903515b701384d73d3296443a86010869fd2c5ceec0e622993f6a23735523132b266b3c3a87282
SSDEEP 24576:ItZ1I+cT9bRQfFWRlT0L7p+kkvbCB0qcA6v2xLAS3lFfXiAHzFZgMMv:ItZyFyp+7Y76v4LPXiGvM
TLSH
T153957B43F66694F9D56AC07887466233BA32B88E07317AFB66D447343E26FD02A3C715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1137116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetLastError GetFinalPathNameByHandleW CreateIoCompletionPort SetFileCompletionNotificationModes GetQueuedCompletionStatusEx Sleep GetModuleHandleA GetProcAddress CompareStringW LCMapStringW SwitchToThread GetStringTypeW PostQueuedCompletionStatus SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter ReleaseSemaphore GetCurrentThread SetThreadStackGuarantee WaitForSingleObject SetConsoleCtrlHandler CreateSemaphoreA IsDebuggerPresent GetCommandLineW GetCommandLineA RtlPcToFileHeader DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection SetConsoleMode GetConsoleMode GetModuleHandleW GetStdHandle GetConsoleOutputCP EncodePointer WriteConsoleW GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA GetCurrentProcess GetCurrentProcessId CreateMutexA ReleaseMutex GetLastError HeapAlloc GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose CreateFileW SetFileInformationByHandle ReadConsoleW RtlUnwindEx SetHandleInformation DeleteFileW CreateThread WriteFileEx SleepEx ReadFileEx CreateWaitableTimerExW SetWaitableTimer ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle SetUnhandledExceptionFilter WaitForMultipleObjects GetExitCodeProcess InitializeSListHead SetFilePointerEx FlushFileBuffers HeapSize LoadLibraryExW VirtualProtect HeapReAlloc EnterCriticalSection GetFileType GetSystemInfo SetStdHandle QueryPerformanceCounter AddVectoredExceptionHandler CloseHandle HeapFree RaiseException MultiByteToWideChar RtlCaptureContext RtlLookupFunctionEntry lstrlenW RtlVirtualUnwind WideCharToMultiByte GetCurrentDirectoryW GetEnvironmentVariableW FormatMessageW QueryPerformanceFrequency CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW FindNextFileW GetProcessHeap IsProcessorFeaturePresent GetSystemTimeAsFileTime GetStartupInfoW FlsAlloc FlsGetValue FlsSetValue FlsFree WriteFile TerminateProcess FreeLibrary GetModuleHandleExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

ws2_32

WSASocketW connect getsockopt recv WSASend shutdown ioctlsocket WSAStartup WSACleanup closesocket send getaddrinfo freeaddrinfo getpeername setsockopt bind getsockname WSAGetLastError WSAIoctl

ntdll

NtDeviceIoControlFile NtCreateFile NtCreateNamedPipeFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile NtReadFile NtOpenFile

secur32

ApplyControlToken QueryContextAttributesW FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle EncryptMessage DecryptMessage AcquireCredentialsHandleA AcceptSecurityContext InitializeSecurityContextW

crypt32

CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertOpenStore CertGetCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateChain CertCloseStore CertDuplicateStore CertDuplicateCertificateContext CertFreeCertificateContext

shell32

ShellExecuteW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

575KB

Virtual Size

575KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-13_510df1f1b7cf8bc498a61f32cd04b0c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ws2_32

ntdll

secur32

crypt32

shell32

advapi32

generic