2026-10-21_99fa214bb4ea6e5a01804c43daab8672_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_99fa214bb4ea6e5a01804c43daab8672_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom
Size 14.6MB
Sample261022-tkatcavy7q
SHA256 59dbdc2e1d3204147664e702d500e3b93eff19ff05158a8c6962aae9fecfeeb6
MD5 99fa214bb4ea6e5a01804c43daab8672
SHA1 87c3253596f1d5616fd8171a3d43d30323863986
SHA512 09fd8d1fabe8b2d58a8a00d5f5ee5bad0e1a57cc115ec4dc3c8946502133ab684cd3e86ecf609aa09e35a57af9a0b132b2190630aa4724c0241087349cd03ea3
SSDEEP 98304:zuRzeR1ctSOuPJmc4aWpx6nxFCS7UbuSP+LrGCbH5y/lUgcnx7d:izeR1uuPJOpxiSuMcLd7d
TLSH
T184F6C516A669A0D9D0BBC078D2839F22BD2174DD473977F389D182692F24EF8AD3D350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_99fa214bb4ea6e5a01804c43daab8672_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

File Explorer

2026-10-21_99fa214bb4ea6e5a01804c43daab8672_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

.exe 14.6MB

2026-10-21_99fa214bb4ea6e5a01804c43daab8672_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

IMPHASH 62618ba85be90d20a7fba28f363706e5
SHA256 59dbdc2e1d3204147664e702d500e3b93eff19ff05158a8c6962aae9fecfeeb6
MD5 99fa214bb4ea6e5a01804c43daab8672
SHA1 87c3253596f1d5616fd8171a3d43d30323863986
SHA512 09fd8d1fabe8b2d58a8a00d5f5ee5bad0e1a57cc115ec4dc3c8946502133ab684cd3e86ecf609aa09e35a57af9a0b132b2190630aa4724c0241087349cd03ea3
SSDEEP 98304:zuRzeR1ctSOuPJmc4aWpx6nxFCS7UbuSP+LrGCbH5y/lUgcnx7d:izeR1uuPJOpxiSuMcLd7d
TLSH
T184F6C516A669A0D9D0BBC078D2839F22BD2174DD473977F389D182692F24EF8AD3D350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11271296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

asterfall_updater-52b71ef0f1605e7d.pdb

bcryptprimitives

ProcessPrng

kernel32

FreeLibrary PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateIoCompletionPort FlsFree FlsSetValue FlsGetValue CancelIoEx WriteFile GetOverlappedResult ReadFile SetFileCompletionNotificationModes SetHandleInformation MoveFileExW GetDiskFreeSpaceExW OpenProcess WaitForSingleObject GetFileInformationByHandle SetFileInformationByHandle CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo GetConsoleMode SetConsoleMode GetCurrentProcess DuplicateHandle GetFileInformationByHandleEx FlsAlloc UnlockFile LockFileEx CreateFileW GetStartupInfoW SetNamedPipeHandleState GetSystemTimeAsFileTime GetFileSizeEx SetStdHandle GetCurrentThreadId IsProcessorFeaturePresent GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage OutputDebugStringW LCMapStringW CompareStringW LoadLibraryExW HeapSize UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetModuleHandleExW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead VirtualProtect HeapReAlloc CreateMutexA LoadLibraryA WaitForSingleObjectEx HeapAlloc GetTempPathW GetProcAddress GetModuleHandleA CreateThread ReadConsoleW WideCharToMultiByte WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFullPathNameW WaitForMultipleObjects ReadFileEx CreateNamedPipeW ExitProcess SetEnvironmentVariableW GetModuleFileNameW FormatMessageW GetModuleHandleW GetFileType CancelIo CopyFileExW GetFinalPathNameByHandleW RemoveDirectoryW DeleteFileW FindFirstFileExW RtlVirtualUnwind FreeEnvironmentStringsW CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread CreateWaitableTimerExW SetWaitableTimer Sleep QueryPerformanceCounter GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW FlushFileBuffers SetFilePointerEx GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess TerminateProcess QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetProcessHeap HeapFree lstrlenW ReleaseMutex FindNextFileW FindClose CreateEventW CreateDirectoryW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

bind WSASocketW closesocket getaddrinfo freeaddrinfo connect WSACleanup WSAStartup listen accept getsockname ioctlsocket getpeername shutdown recv WSARecv send WSASend WSAIoctl getsockopt setsockopt WSAGetLastError

ntdll

NtReadFile NtOpenFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

userenv

GetUserProfileDirectoryW

Name

.text

Size

10.9MB

Virtual Size

10.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

749KB

Virtual Size

749KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_99fa214bb4ea6e5a01804c43daab8672_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

advapi32

bcrypt

shell32

ole32

userenv

generic