2026-09-23_b020a4b66f097de11282b09f424d82e0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_b020a4b66f097de11282b09f424d82e0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
Size 4.7MB
Sample260923-xjdemaaa28
SHA256 deefa529cf69575ef322ae1bc4a60666c921ac04d0544b959b8de73edd0b9442
MD5 b020a4b66f097de11282b09f424d82e0
SHA1 eeb810e1d0b8734a3cde14ec7150dd16727e946c
SHA512 a00b2fdf6000b422408df3c9f9f8d0f1315a3a4dfcfc7e765e72d9068c633202b4657261b48152878065c4f9b023a08aadf6186fbce74a23edac44d5f086ae80
SSDEEP 49152:RCiF9Pig1JYd/iyKSUHZX2iBiBtqfGgXq7bVuDMJjjW5UpZdOiC0zR74XDamaLWd:RRlZTSxQi7xEiCKQD9sWN0kj
TLSH
T17F364B21BF8699EDC15AC074838647726A31B4CA0B35BAEB45D486393F65EF41F3C398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_b020a4b66f097de11282b09f424d82e0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

File Explorer

2026-09-23_b020a4b66f097de11282b09f424d82e0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

.exe 4.7MB

2026-09-23_b020a4b66f097de11282b09f424d82e0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

IMPHASH 96c74c15613b10d501e912b8ebef7446
SHA256 deefa529cf69575ef322ae1bc4a60666c921ac04d0544b959b8de73edd0b9442
MD5 b020a4b66f097de11282b09f424d82e0
SHA1 eeb810e1d0b8734a3cde14ec7150dd16727e946c
SHA512 a00b2fdf6000b422408df3c9f9f8d0f1315a3a4dfcfc7e765e72d9068c633202b4657261b48152878065c4f9b023a08aadf6186fbce74a23edac44d5f086ae80
SSDEEP 49152:RCiF9Pig1JYd/iyKSUHZX2iBiBtqfGgXq7bVuDMJjjW5UpZdOiC0zR74XDamaLWd:RRlZTSxQi7xEiCKQD9sWN0kj
TLSH
T17F364B21BF8699EDC15AC074838647726A31B4CA0B35BAEB45D486393F65EF41F3C398
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3068876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Actix_learn.pdb

bcryptprimitives

ProcessPrng

kernel32

WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle GetProcessHeap WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetProcAddress GetModuleHandleA Sleep WideCharToMultiByte GetFileInformationByHandleEx SwitchToThread CreateFileW GetFileInformationByHandle GetFinalPathNameByHandleW GetConsoleMode GetCurrentProcess GetCurrentThreadId GetModuleHandleW FormatMessageW QueryPerformanceFrequency HeapAlloc ReadConsoleW MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetSystemInfo TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort SetConsoleCtrlHandler SetHandleInformation IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemTimeAsFileTime lstrlenW HeapReAlloc GetFullPathNameW InitializeSListHead CloseHandle HeapFree GetEnvironmentVariableW IsDebuggerPresent

ws2_32

closesocket freeaddrinfo WSAGetLastError getaddrinfo WSAStartup WSACleanup listen bind WSASocketW WSAIoctl connect ioctlsocket setsockopt accept getpeername getsockname send WSASend recv shutdown

iphlpapi

GetIfEntry2 GetAdaptersAddresses SendARP

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtCreateFile NtReadFile

vcruntime140

_CxxThrowException memmove memset memcpy __CxxFrameHandler3 memcmp __C_specific_handler __current_exception_context __current_exception

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _initialize_onexit_table _configure_narrow_argv _initterm terminate _initterm_e _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment _get_initial_narrow_environment _cexit __p___argv __p___argc exit _exit _set_app_type _seh_filter_exe

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_b020a4b66f097de11282b09f424d82e0_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

bcryptprimitives

kernel32

ws2_32

iphlpapi

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic