2026-09-23_ac65e8e1dae3506844d2a442cc04f39e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_ac65e8e1dae3506844d2a442cc04f39e_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 15.1MB
Sample260923-xtytbaae28
SHA256 2ae1d7aff3ad92a3d83fdbaba72a4a92ea3977ee2b8060aba51f20c28edeb40c
MD5 ac65e8e1dae3506844d2a442cc04f39e
SHA1 4ba76130d237dacd224744d83d760873b45f6760
SHA512 ceffb600c4a55b81b7277ea9b3441a325c41373ad1065bea4fc842faeab042ebf913883ec3f0b1fcf6f0743c2d6e55e56823c2c4e0df702ef6c935dbc3c9aaf2
SSDEEP 98304:AwlLGjB0QFt8cT0FwSaFLGfVh1tZwaAZ9/8B2F2YZRvyuXl27UCOAnh:/lMYBfVXD52F2Xh
TLSH
T1C5F6E6157A5A68ADC59AC87083464A734E3430DB1B36B9FF44C592793FA9AF41F3C328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_ac65e8e1dae3506844d2a442cc04f39e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-23_ac65e8e1dae3506844d2a442cc04f39e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 15.1MB

2026-09-23_ac65e8e1dae3506844d2a442cc04f39e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH a850f30d223c9c7406275af1a258511d
SHA256 2ae1d7aff3ad92a3d83fdbaba72a4a92ea3977ee2b8060aba51f20c28edeb40c
MD5 ac65e8e1dae3506844d2a442cc04f39e
SHA1 4ba76130d237dacd224744d83d760873b45f6760
SHA512 ceffb600c4a55b81b7277ea9b3441a325c41373ad1065bea4fc842faeab042ebf913883ec3f0b1fcf6f0743c2d6e55e56823c2c4e0df702ef6c935dbc3c9aaf2
SSDEEP 98304:AwlLGjB0QFt8cT0FwSaFLGfVh1tZwaAZ9/8B2F2YZRvyuXl27UCOAnh:/lMYBfVXD52F2Xh
TLSH
T1C5F6E6157A5A68ADC59AC87083464A734E3430DB1B36B9FF44C592793FA9AF41F3C328
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11412960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

onetaskgraph.pdb

kernel32

SetNamedPipeHandleState GetModuleHandleA Sleep CreateFileW SetHandleInformation CreateIoCompletionPort SetFileCompletionNotificationModes GetModuleHandleW GetSystemTimeAsFileTime GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetProcAddress GetQueuedCompletionStatusEx CancelIoEx PostQueuedCompletionStatus WriteFile GetOverlappedResult ReadFile CloseHandle GetCurrentProcess InitializeSListHead FindNextFileW FormatMessageW GetFileType GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar ReadConsoleW GetModuleFileNameW HeapAlloc DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW TerminateProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle SetUnhandledExceptionFilter FlushFileBuffers ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc HeapFree GetProcessHeap SetFileTime SetFileInformationByHandle MoveFileExW GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW GetLastError CompareStringOrdinal

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSASend connect recv WSASocketW bind shutdown setsockopt WSAIoctl getsockopt getsockname getpeername closesocket send WSAGetLastError ioctlsocket getaddrinfo freeaddrinfo WSAStartup WSACleanup

secur32

FreeCredentialsHandle DecryptMessage DeleteSecurityContext AcquireCredentialsHandleA QueryContextAttributesW ApplyControlToken AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer EncryptMessage

crypt32

CertFreeCertificateChain CertDuplicateCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenStore CertAddCertificateContextToStore CertDuplicateStore

ntdll

NtWriteFile NtReadFile NtOpenFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateNamedPipeFile NtCreateFile

vcruntime140

memset _CxxThrowException memcpy __CxxFrameHandler3 __C_specific_handler memcmp memmove __current_exception_context __current_exception

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

trunc log2 pow fmod ceil __setusermatherr floor

api-ms-win-crt-runtime-l1-1-0

_exit __p___argv _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table __p___argc _configure_narrow_argv _register_onexit_function _set_app_type _crt_atexit _seh_filter_exe exit terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_ac65e8e1dae3506844d2a442cc04f39e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

secur32

crypt32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic