2026-09-25_bdc826313e3397bd40e434c56ebd2260_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_bdc826313e3397bd40e434c56ebd2260_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 2.1MB
Sample260925-y3yekshd76
SHA256 131a21cbcc2b55196c69ba56763c284f8a9b06b0f508cb47cdaa82841b259a23
MD5 bdc826313e3397bd40e434c56ebd2260
SHA1 c1c7c1be2e29df1536289fb98625ae6893b2da5a
SHA512 79f72cd99d77bb5e31b264b779cb5b01a0cd5a5f9aade7709be7da5722ffbe9aa9ab208cddcb7675c7d8295b80291c5ae3c11e6e1b86443776da26732b0dcf4f
SSDEEP 49152:nlFWjemIu8EuFHMarmLkAEwScJOKRSopI+MYIU6i:9mQfTpcMn+
TLSH
T18BA57D03E29584EAC19DC47CC3579A36BA32B88E0735B2EF2BD45A213F26F905B1D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_bdc826313e3397bd40e434c56ebd2260_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-25_bdc826313e3397bd40e434c56ebd2260_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 2.1MB

2026-09-25_bdc826313e3397bd40e434c56ebd2260_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 2d1084e09a89572b92e73e1d1f4cfa37
SHA256 131a21cbcc2b55196c69ba56763c284f8a9b06b0f508cb47cdaa82841b259a23
MD5 bdc826313e3397bd40e434c56ebd2260
SHA1 c1c7c1be2e29df1536289fb98625ae6893b2da5a
SHA512 79f72cd99d77bb5e31b264b779cb5b01a0cd5a5f9aade7709be7da5722ffbe9aa9ab208cddcb7675c7d8295b80291c5ae3c11e6e1b86443776da26732b0dcf4f
SSDEEP 49152:nlFWjemIu8EuFHMarmLkAEwScJOKRSopI+MYIU6i:9mQfTpcMn+
TLSH
T18BA57D03E29584EAC19DC47CC3579A36BA32B88E0735B2EF2BD45A213F26F905B1D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1407280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agente_remoto.pdb

kernel32

GetProcessTimes GetExitCodeProcess LocalFree OpenProcess PostQueuedCompletionStatus DuplicateHandle GetFileAttributesW CreateProcessW GetSystemTimes SleepEx FreeLibrary WriteFileEx CreateThread SetHandleInformation SetFileInformationByHandle CreateFileW GetFullPathNameW ReleaseMutex ReadFileEx GetProcessIoCounters GetCommandLineW CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx AddVectoredExceptionHandler GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetFileCompletionNotificationModes CreateIoCompletionPort GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA GetProcAddress lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleHandleA GetModuleFileNameW QueryPerformanceFrequency GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetSystemInfo CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError ReadProcessMemory SwitchToThread VirtualQueryEx GetCurrentThread GlobalMemoryStatusEx K32GetPerformanceInfo SetThreadStackGuarantee CloseHandle GetSystemTimeAsFileTime WaitForSingleObject InitializeSListHead GetTickCount64 LoadLibraryExA GetLastError GetFileInformationByHandleEx GetFileInformationByHandle SetUnhandledExceptionFilter

ntdll

NtCancelIoFileEx NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtOpenFile NtQueryInformationProcess NtDeviceIoControlFile NtQuerySystemInformation NtWriteFile NtCreateFile RtlGetVersion

ws2_32

recv getaddrinfo setsockopt WSAIoctl WSAStartup WSACleanup ioctlsocket WSASocketW shutdown getsockopt freeaddrinfo getsockname getpeername WSAGetLastError accept listen bind closesocket connect WSASend send

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

GetTokenInformation RegQueryValueExW GetLengthSid RegCloseKey OpenProcessToken CopySid SystemFunction036 RegOpenKeyExW RegSetValueExW IsValidSid

oleaut32

GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

pdh

PdhCloseQuery PdhOpenQueryA PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCollectQueryData PdhRemoveCounter

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

powrprof

CallNtPowerInformation

vcruntime140

__current_exception_context __current_exception memcpy memmove memcmp memset __CxxFrameHandler3 __C_specific_handler

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _seh_filter_exe terminate _register_onexit_function _cexit _set_app_type __p___argv _configure_narrow_argv _crt_atexit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _c_exit _exit __p___argc exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_bdc826313e3397bd40e434c56ebd2260_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

advapi32

oleaut32

bcryptprimitives

pdh

bcrypt

psapi

shell32

powrprof

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic