2026-10-20_3fa07d9dd23548dd83432072564659bf_akira_cobalt-strike_glassworm_megazord_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-20_3fa07d9dd23548dd83432072564659bf_akira_cobalt-strike_glassworm_megazord_rusty-stealer
Size 41.7MB
Sample261020-jg87maxsa1
SHA256 65381c0357d6ec4198367f6a1a904cc7e1112438287e41138015111d05f0fa0e
MD5 3fa07d9dd23548dd83432072564659bf
SHA1 d1517bc46ed73728e832b4e40e0a91451ebc1398
SHA512 7630db3de649bff5d3d5df078fc1df35df6b757e680ed7f6bd6027ea0b3d767afa4f28aec89ecb2b989d2896b9a4b006115ece1f39ab0848c5ece2e49de1d92a
SSDEEP 393216:c/5JQY+RnltsF0+EERMxIIGYS/FmBEIMozi7:cPJcnl/uNmBEIb
TLSH
T1E5A7C61A7674A49AD1BBC0B9C1838F617A2170E90B352BF740D1827A2F35EF96D3D364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_3fa07d9dd23548dd83432072564659bf_akira_cobalt-strike_glassworm_megazord_rusty-stealer

File Explorer

2026-10-20_3fa07d9dd23548dd83432072564659bf_akira_cobalt-strike_glassworm_megazord_rusty-stealer

.exe 41.7MB

2026-10-20_3fa07d9dd23548dd83432072564659bf_akira_cobalt-strike_glassworm_megazord_rusty-stealer

IMPHASH 4c94e45399891a29dd8892a3c1367bf1
SHA256 65381c0357d6ec4198367f6a1a904cc7e1112438287e41138015111d05f0fa0e
MD5 3fa07d9dd23548dd83432072564659bf
SHA1 d1517bc46ed73728e832b4e40e0a91451ebc1398
SHA512 7630db3de649bff5d3d5df078fc1df35df6b757e680ed7f6bd6027ea0b3d767afa4f28aec89ecb2b989d2896b9a4b006115ece1f39ab0848c5ece2e49de1d92a
SSDEEP 393216:c/5JQY+RnltsF0+EERMxIIGYS/FmBEIMozi7:cPJcnl/uNmBEIb
TLSH
T1E5A7C61A7674A49AD1BBC0B9C1838F617A2170E90B352BF740D1827A2F35EF96D3D364
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31180272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

provider_effort_flow-1e43d5ecafc3f53e.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI AssignProcessToJobObject CancelIo CancelIoEx CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectW CreateMutexA CreateMutexW CreateProcessW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatus GetQueuedCompletionStatusEx GetShortPathNameW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathA GetTempPathW GetTickCount GetTimeZoneInformationForYear GetVolumePathNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeConditionVariable InitializeCriticalSection InitializeSListHead InitializeSRWLock K32GetPerformanceInfo LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus Process32FirstW Process32NextW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadDirectoryChangesW ReadFile ReadFileEx ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleTextAttribute SetEndOfFile SetEvent SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetThreadAffinityMask SetThreadErrorMode SetThreadInformation SetThreadPriority SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess Thread32First Thread32Next TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualQueryEx WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize StringFromIID

shell32

CommandLineToArgvW

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt shutdown

userenv

GetUserProfileDirectoryW

mmdevapi

ActivateAudioInterfaceAsync

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhEnumObjectsW PdhGetFormattedCounterValue PdhOpenQueryW PdhRemoveCounter

advapi32

CopySid CredDeleteW CredEnumerateW CredFree CredReadW CredWriteW GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExA RegQueryValueExA SystemFunction036

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

dxgi

CreateDXGIFactory1

combase

CoCreateFreeThreadedMarshaler

bcrypt

BCryptGenRandom

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Mtx_init_in_situ _Mtx_lock _Mtx_unlock

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy _purecall memchr memcmp memcpy memmove memset strchr strrchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsnprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_s _set_fmode fflush fputs

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _callnewh _msize _set_new_mode calloc free malloc realloc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _c_exit _cexit _configure_narrow_argv _crt_atexit _endthreadex _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil ceilf cosf erff expf expm1f floor floorf fmaxf fminf fmod log log2 log2f logf lroundf pow powf round roundf sinf sqrtf tanhf truncf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcat_s strcmp strcspn strlen strncmp strspn wcslen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxASIS OnigSyntaxEmacs OnigSyntaxGnuRegex OnigSyntaxGrep OnigSyntaxJava OnigSyntaxOniguruma OnigSyntaxPerl OnigSyntaxPerl_NG OnigSyntaxPosixBasic OnigSyntaxPosixExtended OnigSyntaxPython OnigSyntaxRuby onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_copy_syntax onig_copyright onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_syntax_behavior onig_get_syntax_op onig_get_syntax_op2 onig_get_syntax_options onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_default_syntax onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_meta_char onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_syntax_behavior onig_set_syntax_op onig_set_syntax_op2 onig_set_syntax_options onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onig_version onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null

Name

.text

Size

29.8MB

Virtual Size

29.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

93KB

Virtual Size

629KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

733B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_3fa07d9dd23548dd83432072564659bf_akira_cobalt-strike_glassworm_megazord_rusty-stealer

kernel32

api-ms-win-core-synch-l1-2-0

ole32

shell32

bcryptprimitives

ntdll

ws2_32

userenv

mmdevapi

pdh

advapi32

psapi

powrprof

oleaut32

api-ms-win-core-winrt-error-l1-1-0

dxgi

combase

bcrypt

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic