2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 25.6MB
Sample261014-py1vgads7x
SHA256 a836bed95a3c865f6acb28121c742b339206fe365866ae4f9fe192c053e7c911
MD5 c22a3099dedd7081f6953be475936f6d
SHA1 bfdc38cbb0617ac638af17084f85e88c78f2b617
SHA512 d181ae23bc06fec4c617bd05f3f422bbde7f7fa8a5b92e23360c97105b41582b983e8770ea523f13f87db2447b1a44ec07c0ed45a811b817df1b51d25a1c0f1c
SSDEEP 196608:uWohT5bIuJCb8X4y2QsucT+px06mpvdSRtdRrfj4qfM6fH:8bPUuJ2QsucT+px06uvdwtdaqfx
TLSH
T1EF47F701BB9E985CD15BC8B4834A4B324B7130CB1A35B9BF60DC55B53FEEAB45A38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

File Explorer

2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

.exe 25.6MB

2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

IMPHASH c12117ef5fbbeeea17f010100778383d
SHA256 a836bed95a3c865f6acb28121c742b339206fe365866ae4f9fe192c053e7c911
MD5 c22a3099dedd7081f6953be475936f6d
SHA1 bfdc38cbb0617ac638af17084f85e88c78f2b617
SHA512 d181ae23bc06fec4c617bd05f3f422bbde7f7fa8a5b92e23360c97105b41582b983e8770ea523f13f87db2447b1a44ec07c0ed45a811b817df1b51d25a1c0f1c
SSDEEP 196608:uWohT5bIuJCb8X4y2QsucT+px06mpvdSRtdRrfj4qfM6fH:8bPUuJ2QsucT+px06uvdwtdaqfx
TLSH
T1EF47F701BB9E985CD15BC8B4834A4B324B7130CB1A35B9BF60DC55B53FEEAB45A38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20325968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

herdr.pdb

kernel32

InitializeProcThreadAttributeList CreateProcessW LoadLibraryExW FlushFileBuffers ReadFile GetOverlappedResult WriteFile DeleteProcThreadAttributeList ReleaseSemaphore GetFileInformationByHandle FlsAlloc FlsGetValue GetConsoleWindow ReadConsoleInputW CreateFileW QueryInformationJobObject SetConsoleMode GetConsoleMode CreatePipe GetFileType GetNamedPipeInfo GetStdHandle FlsSetValue CompareStringOrdinal OpenProcess GetModuleHandleA IsProcessInJob FindClose FindFirstFileW Sleep DiscardVirtualMemory MoveFileExW FormatMessageW GetLastError FlsFree GetFinalPathNameByHandleW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WaitForMultipleObjects SetConsoleCursorInfo SetConsoleCursorPosition GetConsoleScreenBufferInfo DuplicateHandle CreateConsoleScreenBuffer WriteConsoleW GetNumberOfConsoleInputEvents FillConsoleOutputAttribute FillConsoleOutputCharacterA UnregisterWaitEx RegisterWaitForSingleObject CreateNamedPipeW CreateSemaphoreA SetConsoleCtrlHandler GetProcessTimes CreateDirectoryW QueryFullProcessImageNameW VirtualQueryEx SetNamedPipeHandleState WriteFileEx SleepEx ReadFileEx WaitNamedPipeW TerminateProcess GlobalSize ReadProcessMemory Process32NextW Process32FirstW ResumeThread OpenThread Thread32Next Thread32First CreateToolhelp32Snapshot LocalAlloc AssignProcessToJobObject SetInformationJobObject CreateJobObjectW GlobalUnlock GlobalLock GlobalAlloc PeekNamedPipe ConnectNamedPipe DisconnectNamedPipe HeapFree EncodePointer HeapAlloc GetProcessHeap SetConsoleActiveScreenBuffer HeapSize GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FreeLibrary GetProcAddress LoadLibraryExA GetModuleHandleExW RtlPcToFileHeader WaitForSingleObject IsProcessorFeaturePresent IsDebuggerPresent IsWow64Process2 UpdateProcThreadAttribute UnhandledExceptionFilter VirtualProtect CompareStringW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo SetStdHandle LocalFree GlobalFree GetCurrentProcess GetExitCodeProcess GetStringTypeW GetProcessId CloseHandle SetFilePointerEx GetTimeZoneInformation GetCommandLineA GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext UnlockFile LockFileEx GetCurrentProcessId CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SetLastError FreeEnvironmentStringsW ExpandEnvironmentStringsW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW SetFileAttributesW CopyFileExW FindFirstFileExW ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeviceIoControl DeleteFileW SetEnvironmentVariableW GetModuleFileNameW ReadConsoleW MultiByteToWideChar GetConsoleOutputCP GetWindowsDirectoryW CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW GetTempPathW FindNextFileW

ole32

CoUninitialize CoInitializeEx CoCreateGuid CoInitializeSecurity CoCreateInstance CoSetProxyBlanket

combase

CoIncrementMTAUsage

advapi32

GetSecurityDescriptorControl SetSecurityDescriptorControl RegCloseKey OpenProcessToken CopySid ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW GetSidLengthRequired GetSidSubAuthorityCount IsValidSid RegCreateKeyExW AddAce RegOpenKeyExW InitializeAcl GetAclInformation InitializeSecurityDescriptor SetSecurityDescriptorGroup GetSecurityDescriptorGroup SetSecurityDescriptorOwner GetSecurityDescriptorOwner SetSecurityDescriptorSacl GetSecurityDescriptorSacl RegSetValueExW GetTokenInformation SetSecurityDescriptorDacl GetAce GetSecurityDescriptorDacl ConvertSidToStringSidW FreeSid

oleaut32

SafeArrayUnaccessData SysAllocStringLen SysStringLen SysFreeString GetErrorInfo VariantClear SafeArrayAccessData SafeArrayCreateVector

propsys

InitVariantFromInt32Array InitVariantFromDoubleArray InitVariantFromBooleanArray InitVariantFromStringArray InitVariantFromBuffer InitVariantFromInt16Array

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

user32

EmptyClipboard SetClipboardData GetClipboardData SendInput OpenClipboard ChangeWindowMessageFilterEx CreateWindowExW RegisterClassW PostMessageW CloseClipboard GetWindowThreadProcessId DestroyWindow DefWindowProcW RegisterWindowMessageW SetForegroundWindow ShowWindow IsIconic IsWindowVisible GetAncestor GetSystemMetrics EnumClipboardFormats GetForegroundWindow GetKeyboardLayout ToUnicodeEx SendMessageTimeoutW GetMessageW DispatchMessageW GetClassNameW GetClipboardSequenceNumber RegisterClipboardFormatW CountClipboardFormats GetClipboardOwner AllowSetForegroundWindow

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

shell32

ShellExecuteW CommandLineToArgvW

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtAllocateVirtualMemory NtCreateFile NtReadFile NtQueryInformationFile NtSetInformationFile NtClose NtDeviceIoControlFile NtOpenFile NtFreeVirtualMemory NtWriteFile RtlWaitOnAddress RtlWakeAddressSingle RtlWakeAddressAll RtlGetFullPathName_U RtlEqualUnicodeString NtQueryInformationProcess

imm32

ImmGetDefaultIMEWnd

ws2_32

send recv WSAGetLastError getsockopt closesocket

bcryptprimitives

ProcessPrng

Name

.text

Size

19.7MB

Virtual Size

19.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

701KB

Virtual Size

700KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_c22a3099dedd7081f6953be475936f6d_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

kernel32

ole32

combase

advapi32

oleaut32

propsys

api-ms-win-core-winrt-l1-1-0

user32

api-ms-win-core-synch-l1-2-0

shell32

ntdll

imm32

ws2_32

bcryptprimitives

generic