2026-10-01_67888a6dc424c5d77dbdb54880b1b1ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_67888a6dc424c5d77dbdb54880b1b1ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 4.4MB
Sample261002-p92k5stdje
SHA256 56e6962a6e11044f7ac2a087d85ad22ba1750b91eb33f63cf9d13deee97da442
MD5 67888a6dc424c5d77dbdb54880b1b1ed
SHA1 ce85d07c4d9687e12119423ec95eb1baa3afc5d4
SHA512 da5dd5812da0d4add4b6e5767720a5e6ef60b14c70af0afc3f8df5e650e8cfd012924093eb316af4034ac80cc492f199da0a2742048e7a2a2d0881888ea93465
SSDEEP 49152:uifiSaeQoDkk6ikj1pdKxuwU5ndeBsIHl3xxC4Q/ZIxL/j51WmOvr/BVAbuBu3Sh:JlazR/nQB+7DB0Z+U023W
TLSH
T1F4266D02BF8A49EAC19CC874C64747639A22B0CF0B36B6AF16C505353F6A7B55F6D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_67888a6dc424c5d77dbdb54880b1b1ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-01_67888a6dc424c5d77dbdb54880b1b1ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 4.4MB

2026-10-01_67888a6dc424c5d77dbdb54880b1b1ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 710974cec7cf4794c2d383fe312afe52
SHA256 56e6962a6e11044f7ac2a087d85ad22ba1750b91eb33f63cf9d13deee97da442
MD5 67888a6dc424c5d77dbdb54880b1b1ed
SHA1 ce85d07c4d9687e12119423ec95eb1baa3afc5d4
SHA512 da5dd5812da0d4add4b6e5767720a5e6ef60b14c70af0afc3f8df5e650e8cfd012924093eb316af4034ac80cc492f199da0a2742048e7a2a2d0881888ea93465
SSDEEP 49152:uifiSaeQoDkk6ikj1pdKxuwU5ndeBsIHl3xxC4Q/ZIxL/j51WmOvr/BVAbuBu3Sh:JlazR/nQB+7DB0Z+U023W
TLSH
T1F4266D02BF8A49EAC19CC874C64747639A22B0CF0B36B6AF16C505353F6A7B55F6D348
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2256276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

document_search_daemon.pdb

kernel32

LoadLibraryExA HeapFree HeapAlloc GetLastError GetProcessHeap FormatMessageW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId FindNextFileW PostQueuedCompletionStatus IsDebuggerPresent GetSystemTimePreciseAsFileTime QueryPerformanceCounter ExitProcess ReadFile CancelIo UnhandledExceptionFilter SetUnhandledExceptionFilter SystemTimeToFileTime IsProcessorFeaturePresent SystemTimeToTzSpecificLocalTime FindFirstFileExW DeleteFileW FindClose CloseHandle WaitForSingleObject GetExitCodeProcess WaitForMultipleObjects GetOverlappedResult AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetSystemInfo HeapReAlloc SwitchToThread CreateIoCompletionPort SetFileCompletionNotificationModes GetQueuedCompletionStatusEx SetLastError GetFinalPathNameByHandleW Sleep GetModuleHandleA GetProcAddress GetModuleHandleW SetHandleInformation GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency GetModuleFileNameW GetCommandLineW CreateFileW SetFileInformationByHandle GetFullPathNameW CreateDirectoryW GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateNamedPipeW CreateThread WriteFileEx SleepEx ReadFileEx CreateEventW

oleaut32

SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW

secur32

EncryptMessage DecryptMessage ApplyControlToken AcceptSecurityContext InitializeSecurityContextW AcquireCredentialsHandleA QueryContextAttributesW FreeContextBuffer FreeCredentialsHandle DeleteSecurityContext

ws2_32

closesocket getpeername WSAGetLastError ioctlsocket getsockopt shutdown WSASend recv bind setsockopt connect getaddrinfo freeaddrinfo WSAStartup WSACleanup send WSASocketW WSAIoctl getsockname

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtReadFile NtCancelIoFileEx NtWriteFile

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertDuplicateCertificateContext CertOpenStore CertEnumCertificatesInStore CertAddCertificateContextToStore CertCloseStore CertDuplicateStore CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain

vcruntime140

__CxxFrameHandler3 memcpy memmove memcmp _CxxThrowException __C_specific_handler memset __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit __p___argv __p___argc _initterm _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm_e exit _exit _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_67888a6dc424c5d77dbdb54880b1b1ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

oleaut32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

secur32

ws2_32

ntdll

crypt32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic