2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 6.4MB
Sample261002-tmn4razse1
SHA256 91829aa51bf535cc27f0e808ba2688a41192f11287d68604b7eac3838c940367
MD5 3e77721a9dfb577f29f410b1029904cc
SHA1 37c865f5b3b2ba8a56038a56c9d6e541f2dc6c57
SHA512 3e8b89d6d4e7d5f816d28c69320dc496612b5366c152b70c0b1cc98ab8b458154d6427e42b9b76a4be4d44e7031b666ea635d501b433d891eba3721217fb791c
SSDEEP 98304:V/6jhdlGrkgTGLnAOKIG/R2/2AtU023W:Qjro+9tG/RUZp4W
TLSH
T1C4665B027F8A59EAC19CC874C34B8B934A2270CB1A37FABF06C545253F696B55F2C359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 6.4MB

2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH ab9224782bf257466e8d154752cf0e82
SHA256 91829aa51bf535cc27f0e808ba2688a41192f11287d68604b7eac3838c940367
MD5 3e77721a9dfb577f29f410b1029904cc
SHA1 37c865f5b3b2ba8a56038a56c9d6e541f2dc6c57
SHA512 3e8b89d6d4e7d5f816d28c69320dc496612b5366c152b70c0b1cc98ab8b458154d6427e42b9b76a4be4d44e7031b666ea635d501b433d891eba3721217fb791c
SSDEEP 98304:V/6jhdlGrkgTGLnAOKIG/R2/2AtU023W:Qjro+9tG/RUZp4W
TLSH
T1C4665B027F8A59EAC19CC874C34B8B934A2270CB1A37FABF06C545253F696B55F2C359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3716896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

document_search_reader.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile RtlGetVersion RtlNtStatusToDosError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile

ws2_32

getsockopt WSAIoctl ioctlsocket getaddrinfo freeaddrinfo accept bind listen recv send shutdown WSASend WSAStartup setsockopt WSACleanup closesocket connect WSAGetLastError socket WSASocketW

kernel32

GetCurrentProcess lstrlenW CreateMutexA ReleaseMutex WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP LoadLibraryA WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW GetSystemInfo CreateFileW SetFileInformationByHandle WaitForSingleObjectEx GetFileInformationByHandleEx GetFullPathNameW SetFilePointerEx CreateDirectoryW GetCurrentDirectoryW GetProcAddress GetModuleHandleA GetFinalPathNameByHandleW CreateThread ExitProcess QueryPerformanceCounter GetSystemTimePreciseAsFileTime HeapAlloc SetHandleInformation OpenProcess ReadProcessMemory SetLastError GetQueuedCompletionStatusEx SetFileCompletionNotificationModes GetSystemTimes GetProcessIoCounters VirtualQueryEx GlobalMemoryStatusEx CreateIoCompletionPort SwitchToThread GetDiskFreeSpaceExW Sleep SetWaitableTimer CreateWaitableTimerExW LocalFree LocalAlloc GetExitCodeProcess GetProcessTimes GetCurrentProcessId GetTickCount64 WaitForSingleObject GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CloseHandle FindClose DeleteFileW GetLastError SystemTimeToFileTime FindFirstFileExW SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler PostQueuedCompletionStatus GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent FindNextFileW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapReAlloc HeapFree GetFileInformationByHandle GetProcessHeap MultiByteToWideChar IsProcessorFeaturePresent

advapi32

IsValidSid GetTokenInformation CopySid OpenProcessToken GetLengthSid

shell32

CommandLineToArgvW

pdh

PdhAddEnglishCounterW PdhOpenQueryA PdhGetFormattedCounterValue PdhCloseQuery PdhRemoveCounter PdhCollectQueryData

powrprof

CallNtPowerInformation

iphlpapi

GetIfEntry2

ole32

CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

VariantClear SysAllocString SysFreeString

psapi

GetPerformanceInfo GetProcessMemoryInfo GetModuleFileNameExW

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception memcpy memcmp memmove memset _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

pow ceil __setusermatherr truncf

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _c_exit _initterm _initterm_e exit _exit terminate _initialize_onexit_table _crt_atexit _register_onexit_function __p___argc __p___argv _cexit _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_3e77721a9dfb577f29f410b1029904cc_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

ws2_32

kernel32

advapi32

shell32

pdh

powrprof

iphlpapi

ole32

oleaut32

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic