2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 18.7MB
Sample261022-valzassvb1
SHA256 d160aa5b6c7d98493fb4a6d20687eccb9ae8f0a62495397142484369ea333202
MD5 955934ae550ee5fee7940cb6a33184cb
SHA1 9f2f1cce8d604db8f93aa5ff637155f49409e6de
SHA512 e28b2ed4e670c79936e89ef10f44ad935341391103f5fd55ee18840a459f1e2a31923262505a357b9f6b4b822615b751518bc562e12f109f75bc266f349062ae
SSDEEP 196608:PcJZPNNRXdc5t6cAe4ZXGJyIYcyfy0OOZj:PuPNNRXdSLn6X32rg
TLSH
T17F172A26666960D9D1BFC0B8D2838F22BD2174D907392BF745D0827A2F25EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 18.7MB

2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH 0301d4d05f0d9cd25f0f0213b4b6ca6a
SHA256 d160aa5b6c7d98493fb4a6d20687eccb9ae8f0a62495397142484369ea333202
MD5 955934ae550ee5fee7940cb6a33184cb
SHA1 9f2f1cce8d604db8f93aa5ff637155f49409e6de
SHA512 e28b2ed4e670c79936e89ef10f44ad935341391103f5fd55ee18840a459f1e2a31923262505a357b9f6b4b822615b751518bc562e12f109f75bc266f349062ae
SSDEEP 196608:PcJZPNNRXdc5t6cAe4ZXGJyIYcyfy0OOZj:PuPNNRXdSLn6X32rg
TLSH
T17F172A26666960D9D1BFC0B8D2838F22BD2174D907392BF745D0827A2F25EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10403456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

asterfall_client-9132912dbf035581.pdb

kernel32

GetModuleFileNameW FlsAlloc SetThreadErrorMode FlsSetValue LocalFree GetCurrentProcess FlsGetValue GetModuleHandleExW ConnectNamedPipe CreateNamedPipeW FreeLibrary CloseHandle MoveFileExW GetCurrentThreadId GetCurrentProcessId GetSystemDirectoryW GetProcAddress GetFileInformationByHandle GlobalMemoryStatusEx SetHandleInformation GetShortPathNameW RemoveDllDirectory AddDllDirectory PostQueuedCompletionStatus IsProcessorFeaturePresent FlsFree GetQueuedCompletionStatusEx GetStartupInfoW GetSystemTimeAsFileTime SetFileCompletionNotificationModes GetACP GetLastError WriteFile GetOverlappedResult GetFileAttributesW CreateIoCompletionPort ReadFile LoadLibraryExW LCMapStringW CompareStringW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP IsValidCodePage HeapSize UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetEnvironmentStringsW FindNextFileW GetTempPathW GetModuleHandleA WaitForMultipleObjects FormatMessageW GetModuleHandleW GetFileType Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar HeapAlloc SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess CreateHardLinkW FindClose FindFirstFileExW RemoveDirectoryW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW TerminateProcess GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo QueryPerformanceFrequency QueryPerformanceCounter RtlVirtualUnwind CompareStringOrdinal WaitForSingleObject FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc CreateThread CreateEventW ReadFileEx FlushFileBuffers DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetProcessId

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW RegGetValueW SystemFunction036

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

IsHungAppWindow IsWindowVisible GetForegroundWindow GetWindowThreadProcessId GetGUIThreadInfo GetSystemMetrics EnumThreadWindows GetCurrentInputMessageSource MapVirtualKeyW GetKeyState

ws2_32

getsockopt closesocket setsockopt getsockname getpeername WSASend WSAIoctl bind recv send accept listen ioctlsocket WSASocketW connect WSAGetLastError select getaddrinfo WSACleanup WSAStartup freeaddrinfo

ntdll

NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile NtWriteFile NtReadFile RtlDllShutdownInProgress RtlNtStatusToDosError NtCreateFile NtCancelIoFileEx

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

Name

.text

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

710KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_955934ae550ee5fee7940cb6a33184cb_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

user32

ws2_32

ntdll

bcryptprimitives

bcrypt

userenv

generic