2026-09-23_2295c525cf2699fc4978a0b855b2b901_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_2295c525cf2699fc4978a0b855b2b901_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 10.0MB
Sample260924-prp5dstfjc
SHA256 a2df3e78b2037267332446b42c88fe38c852e7d3686efa2c78a8655762ec4535
MD5 2295c525cf2699fc4978a0b855b2b901
SHA1 4b3d74774f8b77287df0f93750a630489d240990
SHA512 65c2c5874bfa1495e8326112395ad21152a29ea1aaeff238d0464f79aea6c11653cc6423c88201d71898301b6c116ec47e65f71826ebff1d193caee7ae4ceda4
SSDEEP 98304:voRqY7sqFxiU+Pc+wzItK2dhrRqyOPwze+e7:8VFxiU+kTzItK2dhrRqyOPxJ7
TLSH
T1C6B62B11778E5979D2DAC4B9C2570B234F7570CB121438BFB4ACC2781FED9A81B6A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_2295c525cf2699fc4978a0b855b2b901_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-23_2295c525cf2699fc4978a0b855b2b901_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 10.0MB

2026-09-23_2295c525cf2699fc4978a0b855b2b901_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH b068c0ab62af97f7e581cb8cd1280af7
SHA256 a2df3e78b2037267332446b42c88fe38c852e7d3686efa2c78a8655762ec4535
MD5 2295c525cf2699fc4978a0b855b2b901
SHA1 4b3d74774f8b77287df0f93750a630489d240990
SHA512 65c2c5874bfa1495e8326112395ad21152a29ea1aaeff238d0464f79aea6c11653cc6423c88201d71898301b6c116ec47e65f71826ebff1d193caee7ae4ceda4
SSDEEP 98304:voRqY7sqFxiU+Pc+wzItK2dhrRqyOPwze+e7:8VFxiU+kTzItK2dhrRqyOPxJ7
TLSH
T1C6B62B11778E5979D2DAC4B9C2570B234F7570CB121438BFB4ACC2781FED9A81B6A31A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4989536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hol_guard_runtime.pdb

bcryptprimitives

ProcessPrng

kernel32

GetSystemTimeAsFileTime CloseHandle LocalFree FormatMessageW GetLastError GetCurrentProcess DuplicateHandle GetFileInformationByHandleEx GetProcAddress SetFileInformationByHandle LockFileEx UnlockFile GetSystemInfo GlobalMemoryStatusEx GetCurrentThreadId InitializeSListHead GetCurrentProcessId CreateFileW SetUnhandledExceptionFilter VirtualQueryEx CreateToolhelp32Snapshot Process32FirstW Process32NextW GetExitCodeProcess GetProcessHeap HeapFree ReadProcessMemory GetProcessTimes GetSystemTimes K32GetPerformanceInfo GetProcessIoCounters OpenProcess HeapAlloc InitializeProcThreadAttributeList SetHandleInformation CreatePipe TerminateProcess TerminateJobObject AssignProcessToJobObject GetProcessId DeleteProcThreadAttributeList GetFileInformationByHandle GetFileType CreateDirectoryW CreateProcessW UpdateProcThreadAttribute CreateJobObjectW ResumeThread LocalAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread CreateWaitableTimerExW SetWaitableTimer Sleep QueryPerformanceCounter SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW FlushFileBuffers SetFilePointerEx GetStdHandle WaitForSingleObject QueryPerformanceFrequency GetSystemTimePreciseAsFileTime FindFirstFileExW FindClose HeapReAlloc lstrlenW ReleaseMutex GetModuleHandleW GetModuleFileNameW ExitProcess CreateThread GetFullPathNameW GetModuleHandleA CreateMutexA LoadLibraryA WaitForSingleObjectEx ReadConsoleW WideCharToMultiByte WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetFinalPathNameByHandleW FindNextFileW DeleteFileW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

closesocket send accept ioctlsocket WSAStartup WSACleanup WSASocketW WSAGetLastError setsockopt connect bind listen getsockname getsockopt recv WSARecv select WSASend

advapi32

CopySid GetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo OpenProcessToken GetTokenInformation IsValidSid ConvertStringSidToSidW ConvertSidToStringSidW GetLengthSid EqualSid ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorOwner GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW GetSidLengthRequired GetAce GetAclInformation GetSidSubAuthorityCount

pdh

PdhOpenQueryA PdhGetFormattedCounterValue PdhCloseQuery PdhCollectQueryData PdhAddEnglishCounterW PdhEnumObjectsA PdhRemoveCounter

powrprof

CallNtPowerInformation

ntdll

NtSetInformationFile RtlNtStatusToDosError RtlVirtualUnwind RtlGetVersion RtlCaptureContext RtlLookupFunctionEntry NtReadFile NtWriteFile NtQueryInformationProcess

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

oleaut32

GetErrorInfo

vcruntime140

memcmp __current_exception_context __current_exception __C_specific_handler _CxxThrowException memmove memset memcpy __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm __p___argc __p___argv _cexit _c_exit _get_initial_narrow_environment _initialize_narrow_environment _set_app_type _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv _seh_filter_exe _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_2295c525cf2699fc4978a0b855b2b901_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

advapi32

pdh

powrprof

ntdll

psapi

shell32

oleaut32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic