2026-09-24_10c49fd69da9883d30f1557cfbd2feba_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_10c49fd69da9883d30f1557cfbd2feba_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
Size 9.3MB
Sample260925-r8p7tsvsds
SHA256 a4da2c4351ec8928ad3c229c3e1565a48465cb1f644dab4ef54cece24be750c4
MD5 10c49fd69da9883d30f1557cfbd2feba
SHA1 452db6240d6ae501fa1e394b1a14614add9d7a15
SHA512 161de0d53780dcd454d7ca0e0e9623fdb0e20e3bc4785b5d8d85b8e1fbdc13e2b9adf5266d5f5dd71e29fab7a9de08d7032cccaa0ca3a96c098d7e8525ea3f76
SSDEEP 98304:tRu9kZAQMfmIPS10OEdVvVq6g/MVFZx0xH+JyrGeiM:julOSiLa7Hg/v0y
TLSH
T12DA609316E5A55AFC756C4F0C34A4A625E2134CB0B26B9FF44C453383F79ABCDA29E24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_10c49fd69da9883d30f1557cfbd2feba_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

File Explorer

2026-09-24_10c49fd69da9883d30f1557cfbd2feba_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

.exe 9.3MB

2026-09-24_10c49fd69da9883d30f1557cfbd2feba_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

IMPHASH a617720337dd017b3f6b8a54d6b308bf
SHA256 a4da2c4351ec8928ad3c229c3e1565a48465cb1f644dab4ef54cece24be750c4
MD5 10c49fd69da9883d30f1557cfbd2feba
SHA1 452db6240d6ae501fa1e394b1a14614add9d7a15
SHA512 161de0d53780dcd454d7ca0e0e9623fdb0e20e3bc4785b5d8d85b8e1fbdc13e2b9adf5266d5f5dd71e29fab7a9de08d7032cccaa0ca3a96c098d7e8525ea3f76
SSDEEP 98304:tRu9kZAQMfmIPS10OEdVvVq6g/MVFZx0xH+JyrGeiM:julOSiLa7Hg/v0y
TLSH
T12DA609316E5A55AFC756C4F0C34A4A625E2134CB0B26B9FF44C453383F79ABCDA29E24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6511792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

myAviLink.pdb

ntdll

NtCreateFile RtlGetVersion NtWriteFile NtReadFile NtCancelIoFileEx NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtDeviceIoControlFile

kernel32

HeapReAlloc GetSystemTimePreciseAsFileTime HeapFree GetProcessHeap GetModuleHandleA GetProcAddress Sleep IsDebuggerPresent SetThreadStackGuarantee GetCurrentThread GetLastError SetWaitableTimer CloseHandle CompareStringOrdinal SetFilePointerEx FindNextFileW GetFinalPathNameByHandleW MoveFileExW GetUserDefaultUILanguage LCIDToLocaleName DeleteFileW GetFileAttributesW CreateDirectoryW GetFileInformationByHandleEx GetSystemDirectoryW WaitForSingleObject GetSystemInfo FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW WriteFileEx ReadFileEx GetWindowsDirectoryW CancelIoEx GetSystemTimeAsFileTime CreateIoCompletionPort ExitProcess SetHandleInformation FormatMessageW GetModuleHandleW LocalFree GetQueuedCompletionStatusEx ReadFile WriteFile GetOverlappedResult FlushFileBuffers PostQueuedCompletionStatus GetFileInformationByHandle OpenEventW SetEvent SleepEx SleepConditionVariableSRW IsProcessorFeaturePresent CreateMutexW CreateEventW HeapAlloc MultiByteToWideChar Process32NextW Process32FirstW CreateToolhelp32Snapshot SwitchToThread CreateProcessW LoadLibraryExA ReleaseMutex WriteConsoleW GetConsoleOutputCP OutputDebugStringA OutputDebugStringW LoadLibraryExW FreeLibrary WideCharToMultiByte GetConsoleMode GetCurrentProcessId CreateFileW GetStdHandle CreateMutexA lstrlenW GetCurrentProcess WakeAllConditionVariable WaitForSingleObjectEx SetLastError RtlLookupFunctionEntry GetCurrentThreadId LoadLibraryW AcquireSRWLockExclusive LoadLibraryA GetModuleFileNameW AttachConsole CreateWaitableTimerExW ReleaseSRWLockExclusive SetFileCompletionNotificationModes DuplicateHandle TerminateProcess CreateThread InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter AddVectoredExceptionHandler QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

PostQuitMessage CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SetCapture ReleaseCapture MonitorFromRect ScreenToClient MsgWaitForMultipleObjectsEx CheckMenuItem PostMessageW GetActiveWindow SendInput LoadCursorW GetForegroundWindow DispatchMessageW IsIconic IsWindowVisible RemoveMenu DrawMenuBar GetWindow GetAsyncKeyState SetFocus SetMenu RegisterTouchWindow SetWindowDisplayAffinity GetUpdateRect PostThreadMessageW SystemParametersInfoA SetCursor GetRawInputData CreateAcceleratorTableW EnumChildWindows DispatchMessageA TranslateMessage GetMessageA ChangeWindowMessageFilterEx SendMessageW RegisterClassW SetMenuItemInfoW DrawIconEx AppendMenuW VkKeyScanW CreatePopupMenu CreateMenu RedrawWindow MonitorFromPoint EnumDisplayMonitors RegisterRawInputDevices GetMessageW CreateWindowExW RegisterClassExW CreateIcon DestroyWindow DestroyAcceleratorTable SetTimer DestroyIcon KillTimer DestroyMenu SetWindowLongPtrW GetWindowLongPtrW SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW DefWindowProcW SetPropW GetKeyboardState GetMonitorInfoW MapVirtualKeyW MessageBoxW SetForegroundWindow ShowWindow GetWindowPlacement AdjustWindowRectEx GetMenu GetWindowLongW ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout GetKeyState SetWindowLongW EnableMenuItem GetSystemMenu InvalidateRgn SetWindowPos ClipCursor GetSystemMetrics GetClipCursor ShowCursor SystemParametersInfoW FindWindowW AllowSetForegroundWindow ValidateRect RegisterWindowMessageA IsProcessDPIAware GetDC MonitorFromWindow TrackPopupMenu ClientToScreen GetCursorPos DrawTextW ReleaseDC GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo FillRect GetMenuItemInfoW

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass

gdi32

GetDeviceCaps DeleteObject SetTextColor SetBkMode CreateSolidBrush CreateRectRgn DeleteDC SelectObject CreateDIBSection CreateCompatibleDC

shell32

Shell_NotifyIconGetRect Shell_NotifyIconW DragFinish DragQueryFileW SHGetKnownFolderPath SHAppBarMessage

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree RevokeDragDrop CoTaskMemAlloc OleInitialize RegisterDragDrop CoCreateFreeThreadedMarshaler

advapi32

RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW RegGetValueW RegCreateKeyExW RegDeleteValueW EventUnregister SystemFunction036 EventRegister EventWriteTransfer EventSetInformation

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext

bcryptprimitives

ProcessPrng

ws2_32

WSAIoctl ioctlsocket send recv freeaddrinfo getaddrinfo WSACleanup WSAStartup WSASend getsockopt WSAGetLastError recvfrom closesocket bind getpeername getsockname connect WSASocketW shutdown setsockopt sendto

crypt32

CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChain CertSetCertificateContextProperty CertOpenStore CertCloseStore CertCreateCertificateChainEngine CryptUnprotectData CertFreeCertificateContext CertFreeCertificateChainEngine CertAddEncodedCertificateToStore CryptProtectData

bcrypt

BCryptGenRandom

iphlpapi

GetExtendedTcpTable

vcruntime140

memcpy memcmp memmove memset __CxxFrameHandler3 _CxxThrowException wcsrchr _purecall __C_specific_handler __std_exception_destroy __current_exception __current_exception_context __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

roundf trunc round pow floor __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp wcscmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _initialize_narrow_environment _exit _cexit _c_exit _configure_narrow_argv _initterm _register_thread_local_exe_atexit_callback _initterm_e exit _get_initial_narrow_environment __p___argc _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit _set_app_type terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_10c49fd69da9883d30f1557cfbd2feba_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

user32

comctl32

gdi32

shell32

oleaut32

ole32

advapi32

dwmapi

shlwapi

imm32

bcryptprimitives

ws2_32

crypt32

bcrypt

iphlpapi

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic