2026-10-06_3ba988e8d74d5e1162eb675db68949c8_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

General

Target
2026-10-06_3ba988e8d74d5e1162eb675db68949c8_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom
Size 5.8MB
Sample261006-rft1bazzht
SHA256 f4b48c671b13560a81a7fd16326e88532fef1746363434dc24d95e69ade09f8b
MD5 3ba988e8d74d5e1162eb675db68949c8
SHA1 603615e99deadc6c788ebb059e3e81d6a4dbf4cf
SHA512 42fba46e3ca99f0148862254759768a9a3759a7963b9a540c902968b3d39cb666159b9ee0232673ca1b1632725a7d0a54be6c7c6c0671dfb92857d88f54b1096
SSDEEP 49152:pFUjxJGE83Aa0vJbDpc4r2pUC6g3ee3FHjIRkChG1pDPspM2PmOgTN1dRxgWPusZ:BvFVvvtEtwD
TLSH
T15356C72666B9A0DAC17BC0B8D1838F217D2270D90B362FF74091827A2F25DF96D7D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_3ba988e8d74d5e1162eb675db68949c8_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

File Explorer

2026-10-06_3ba988e8d74d5e1162eb675db68949c8_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

.exe 5.8MB

2026-10-06_3ba988e8d74d5e1162eb675db68949c8_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

IMPHASH 46e8a94a613ccab9a526b3ce198a1339
SHA256 f4b48c671b13560a81a7fd16326e88532fef1746363434dc24d95e69ade09f8b
MD5 3ba988e8d74d5e1162eb675db68949c8
SHA1 603615e99deadc6c788ebb059e3e81d6a4dbf4cf
SHA512 42fba46e3ca99f0148862254759768a9a3759a7963b9a540c902968b3d39cb666159b9ee0232673ca1b1632725a7d0a54be6c7c6c0671dfb92857d88f54b1096
SSDEEP 49152:pFUjxJGE83Aa0vJbDpc4r2pUC6g3ee3FHjIRkChG1pDPspM2PmOgTN1dRxgWPusZ:BvFVvvtEtwD
TLSH
T15356C72666B9A0DAC17BC0B8D1838F217D2270D90B362FF74091827A2F25DF96D7D764
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4326784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

test_stdio_server.pdb

bcryptprimitives

ProcessPrng

kernel32

GetStartupInfoW RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree WriteFile EncodePointer PostQueuedCompletionStatus GetQueuedCompletionStatusEx OutputDebugStringW GetSystemTimeAsFileTime DuplicateHandle GetCurrentProcess Sleep GetModuleHandleA GetModuleHandleExW VirtualProtect LoadLibraryExW CompareStringW FormatMessageW LCMapStringW IsProcessorFeaturePresent SetStdHandle IsDebuggerPresent FreeLibrary IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW HeapSize GetProcessId CreateIoCompletionPort GetModuleHandleW GetProcAddress WideCharToMultiByte ReadConsoleW GetConsoleMode GetStdHandle TlsSetValue SetLastError TlsAlloc TlsGetValue ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceExecuteOnce GetLastError CreateFileW HeapFree HeapAlloc GetProcessHeap CloseHandle GetCommandLineA SetEnvironmentVariableW GetFileSizeEx FindNextFileW GetModuleFileNameW UnhandledExceptionFilter DeleteCriticalSection GetFileType GetFileAttributesW GetFinalPathNameByHandleW InitializeCriticalSectionEx LeaveCriticalSection ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx TerminateProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetFileInformationByHandle RtlLookupFunctionEntry GetConsoleOutputCP EnterCriticalSection RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead RtlCaptureContext FlushFileBuffers ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SleepEx WriteConsoleW WriteFileEx MultiByteToWideChar FreeEnvironmentStringsW WaitForSingleObject CompareStringOrdinal RtlVirtualUnwind

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtCreateNamedPipeFile NtOpenFile NtReadFile

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

351KB

Virtual Size

351KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_3ba988e8d74d5e1162eb675db68949c8_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

generic