2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 1.6MB
Sample261003-pl2agada95
SHA256 6e6afb4cbcb63171359f9b0f4375e9bc41bf29189c18f52789e445e4bcb6c52a
MD5 55cc9ad26162ae6ac7fcde4e9285b918
SHA1 60dd8b3cd2aa278e0e4d95bbc491e7158b3051ce
SHA512 d64c28e853079eeeec0987dc778cf8e67049ac8325995f801fa08daf9038570e0869b0a95d8a0eaeb703fb71570fd835dd3fa35a4207d3a2b22c797811bdfbdb
SSDEEP 24576:2Y9sj5KkX4Gy+4f7aCvUT739+LHK8mm9U/HPo78UsENMnEj:2Y9sjskXjym73ErK8mCUef2E
TLSH
T184757D47F56680EDC17DC131875A6126BB35784D47283EEB3BDC42217F62BE06A3AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 1.6MB

2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH ea401d9b62c14285bd00c7461052dc6c
SHA256 6e6afb4cbcb63171359f9b0f4375e9bc41bf29189c18f52789e445e4bcb6c52a
MD5 55cc9ad26162ae6ac7fcde4e9285b918
SHA1 60dd8b3cd2aa278e0e4d95bbc491e7158b3051ce
SHA512 d64c28e853079eeeec0987dc778cf8e67049ac8325995f801fa08daf9038570e0869b0a95d8a0eaeb703fb71570fd835dd3fa35a4207d3a2b22c797811bdfbdb
SSDEEP 24576:2Y9sj5KkX4Gy+4f7aCvUT739+LHK8mm9U/HPo78UsENMnEj:2Y9sjskXjym73ErK8mCUef2E
TLSH
T184757D47F56680EDC17DC131875A6126BB35784D47283EEB3BDC42217F62BE06A3AB09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1224048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtWriteFile NtReadFile RtlGetVersion NtQuerySystemInformation RtlNtStatusToDosError

kernel32

GetSystemDirectoryA VirtualProtect HeapReAlloc GetModuleHandleW GetProcAddress GetModuleFileNameW GetModuleHandleExW HeapAlloc GetSystemInfo SetLastError GetTickCount GetModuleHandleA VirtualAlloc GetSystemDirectoryW SetHandleInformation GetLastError GlobalMemoryStatusEx MapViewOfFile HeapFree GetProcessHeap VirtualQuery CreateFileMappingW GetNativeSystemInfo GetSystemTimeAsFileTime GetDllDirectoryW FreeLibrary UnmapViewOfFile SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentProcess CreateFileW Sleep SetFilePointerEx SwitchToThread WaitForSingleObject ExitThread CreatePipe UnhandledExceptionFilter SetStdHandle CreateThread GetExitCodeThread TlsAlloc RtlAddFunctionTable GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte lstrlenW GetEnvironmentVariableW FormatMessageW GetTempPathW GetCommandLineW GetFileInformationByHandle GetFullPathNameW FindClose ExitProcess QueryPerformanceCounter QueryPerformanceFrequency FindFirstFileW GetLongPathNameW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW AreFileApisANSI RaiseException TerminateProcess GetCurrentThreadId IsProcessorFeaturePresent GetTimeZoneInformation GetStdHandle

advapi32

SystemFunction036 RegOpenKeyExW RegQueryValueExW OpenProcessToken RegEnumKeyW StartServiceW OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW

secur32

DecryptMessage DeleteSecurityContext FreeCredentialsHandle FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW AcquireCredentialsHandleA QueryContextAttributesW EncryptMessage

crypt32

CertFreeCertificateChain CryptStringToBinaryA CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertCreateCertificateContext CertDuplicateCertificateContext CertOpenStore CertAddCertificateContextToStore CertFreeCertificateContext CertCloseStore CertGetCertificateChain CertEnumCertificatesInStore CertDuplicateStore

shell32

ShellExecuteW

ws2_32

bind recv send select ioctlsocket closesocket WSAGetLastError connect setsockopt getaddrinfo freeaddrinfo WSAStartup WSACleanup sendto WSASetLastError getsockopt

msvcrt

__C_specific_handler memcpy memset memcmp memmove _amsg_exit strlen free _initterm _errno __getmainargs _environ realloc _msize _XcptFilter __set_app_type _fmode __argc __argv ?_set_new_mode@@YAHH@Z _commode ?terminate@@YAXXZ __CxxFrameHandler

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.obfscst

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom

ntdll

kernel32

advapi32

secur32

crypt32

shell32

ws2_32

msvcrt

generic