2026-09-28_01b87212459ef668aae42414028b9d00_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_01b87212459ef668aae42414028b9d00_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 29.0MB
Sample260929-ptpxea1xev
SHA256 410418976a4067ed5883033135661851aa781a2f537089da939e262725680be8
MD5 01b87212459ef668aae42414028b9d00
SHA1 72b2ea00685e5709e10a7eb4eff0c56c8aeb9d60
SHA512 8cd1da5f22d00ae3719e649a055316ff22ea1133f912a18cb110edb328e48d77c0e51d7967874824295c31063a68d19fd67c4770fa4a589c374b0830d7133f40
SSDEEP 196608:j2RkV9HlfnIDc/05l9RVw11Af9unX6yE:Ykpo4053g1Af9LyE
TLSH
T16467E6117A9FA8ADD19AC874834A4AB30F2130DB1A26B9FF40C556353FBDAB45B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_01b87212459ef668aae42414028b9d00_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-28_01b87212459ef668aae42414028b9d00_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 29.0MB

2026-09-28_01b87212459ef668aae42414028b9d00_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 6af6fc8f8eee2a8070eba8e8809186e8
SHA256 410418976a4067ed5883033135661851aa781a2f537089da939e262725680be8
MD5 01b87212459ef668aae42414028b9d00
SHA1 72b2ea00685e5709e10a7eb4eff0c56c8aeb9d60
SHA512 8cd1da5f22d00ae3719e649a055316ff22ea1133f912a18cb110edb328e48d77c0e51d7967874824295c31063a68d19fd67c4770fa4a589c374b0830d7133f40
SSDEEP 196608:j2RkV9HlfnIDc/05l9RVw11Af9unX6yE:Ykpo4053g1Af9LyE
TLSH
T16467E6117A9FA8ADD19AC874834A4AB30F2130DB1A26B9FF40C556353FBDAB45B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23684352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

onepipeline.pdb

kernel32

SetLastError GetFullPathNameW GetCurrentThreadId ReadFileEx ReadFile CreateEventW GetOverlappedResult SetFileTime CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW CreateDirectoryW SetThreadStackGuarantee GetCurrentThread RemoveDirectoryW CopyFileExW FindFirstFileExW CreateHardLinkW ExitProcess SetFileInformationByHandle LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW ReadConsoleW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW GetFileType GetModuleHandleW WaitForMultipleObjects GetTempPathW CancelIo FindNextFileW GlobalAlloc LocalFree SetFilePointerEx GetSystemInfo SetConsoleCtrlHandler MoveFileExW GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter SetEnvironmentVariableW TerminateProcess GlobalFree GetDiskFreeSpaceExW GetVolumePathNameW DuplicateHandle GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetBinaryTypeW SleepEx WriteFileEx QueryInformationJobObject SetInformationJobObject CreateJobObjectW OpenJobObjectW TerminateJobObject GetProcessTimes GetCurrentProcess AddVectoredExceptionHandler GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW WideCharToMultiByte OpenProcess MultiByteToWideChar FormatMessageW GetSystemTimePreciseAsFileTime GetExitCodeProcess WaitForSingleObject ResumeThread OpenThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind Thread32Next SetHandleInformation Thread32First CreateToolhelp32Snapshot GetProcessId AssignProcessToJobObject SwitchToThread FindClose CreateThread GetCurrentProcessId Process32NextW UnlockFile LockFileEx GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle HeapReAlloc HeapFree Process32FirstW GetProcessHeap PeekNamedPipe FlushFileBuffers InitializeSListHead GetProcAddress GetModuleHandleA Sleep CloseHandle WaitForSingleObjectEx GetLastError SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

crypt32

CertCloseStore CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CertGetCertificateChain CertOpenStore CertAddEncodedCertificateToStore CertFreeCertificateContext CertSetCertificateContextProperty CertFreeCertificateChain

ntdll

RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

ws2_32

getsockname WSACleanup getpeername WSASocketW select bind getsockopt ioctlsocket getaddrinfo listen send recv WSAGetLastError setsockopt closesocket WSAStartup freeaddrinfo connect

vcruntime140

memcmp __current_exception_context __CxxFrameHandler3 memcpy memset memmove __current_exception _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

pow log2 floor __setusermatherr fmod ceil round trunc

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _get_initial_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type _initterm _seh_filter_exe _cexit _initterm_e _exit exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_01b87212459ef668aae42414028b9d00_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

crypt32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic