2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 17.2MB
Sample261023-hstqmscd62
SHA256 f2c11a4f9eb085f6e3f50c132880dac075591c0552a0f7a6ad3f9465f893c310
MD5 d887fcd0621872c07debc552702dbf63
SHA1 579896525b44679836304888793f2f62dd43a511
SHA512 166f66bf566f3e264e15e0f5aaa7b958afbeaf1a1d90110f09c7e88b70e70f7dfe862535ab0159c57398f2c555d430213b506434a424e574cedee344f889d925
SSDEEP 196608:rGUe7Y3ofsp/Td3KBYWhzB/Ad0JJZh0tLGaAOjpB:rxeM3WXzB/A6JZgLGaAOjpB
TLSH
T1A5076B03F39291EDC46AC1B4835AA233FA717C4D47347AEB5BD48B212E65BD09A3C749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 17.2MB

2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 010f53a66cb31c1b13cbf063952c7766
SHA256 f2c11a4f9eb085f6e3f50c132880dac075591c0552a0f7a6ad3f9465f893c310
MD5 d887fcd0621872c07debc552702dbf63
SHA1 579896525b44679836304888793f2f62dd43a511
SHA512 166f66bf566f3e264e15e0f5aaa7b958afbeaf1a1d90110f09c7e88b70e70f7dfe862535ab0159c57398f2c555d430213b506434a424e574cedee344f889d925
SSDEEP 196608:rGUe7Y3ofsp/Td3KBYWhzB/Ad0JJZh0tLGaAOjpB:rxeM3WXzB/A6JZgLGaAOjpB
TLSH
T1A5076B03F39291EDC46AC1B4835AA233FA717C4D47347AEB5BD48B212E65BD09A3C749
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10978560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oSsSVzsSsVOVSzO.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

user32

SetCursor LoadCursorW ClientToScreen SetCursorPos InvalidateRgn SetWindowPos ChangeDisplaySettingsExW SetWindowPlacement CreateWindowExW RegisterClassExW DefWindowProcW GetClassInfoExW GetClassNameW GetWindowPlacement GetClientRect EmptyClipboard SetPropW SetWindowLongPtrW GetPropW ReleaseCapture GetWindowLongPtrW SendMessageW GetActiveWindow RedrawWindow TranslateMessage DispatchMessageW PeekMessageW IsClipboardFormatAvailable CallWindowProcW RegisterTouchWindow DestroyWindow SystemParametersInfoA PostMessageW GetClipboardData SetWindowDisplayAffinity EnumDisplayMonitors OpenClipboard RemovePropW RegisterRawInputDevices RegisterWindowMessageA GetMessageW CloseClipboard SetCapture MapVirtualKeyW SetTimer KillTimer DestroyCursor DestroyIcon SetClipboardData SetForegroundWindow GetDC FlashWindowEx GetSystemMetrics ShowWindow GetForegroundWindow GetSystemMenu EnableMenuItem SetWindowLongW GetKeyboardState GetWindowLongW GetMenu AdjustWindowRectEx GetClipCursor GetAsyncKeyState ClipCursor ShowCursor ReleaseDC CloseTouchInputHandle SendInput RegisterClipboardFormatW GetTouchInputInfo TrackMouseEvent UpdateWindow SetWindowLongA MonitorFromRect ScreenToClient MonitorFromPoint GetMonitorInfoW FindWindowExA ValidateRect CreateIcon MapVirtualKeyExW GetKeyboardLayout MonitorFromWindow ToUnicodeEx GetKeyState GetCursorPos IsProcessDPIAware GetRawInputData IsIconic GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW CreateIconFromResourceEx

kernel32

GetExitCodeProcess WaitForSingleObject RtlVirtualUnwind GetProcessTimes HeapFree GetProcessHeap GetSystemTimes GetProcessIoCounters WaitForMultipleObjects CancelWaitableTimer GetProcAddress CloseHandle ReadProcessMemory SetWaitableTimerEx GetSystemTimeAsFileTime InitializeSListHead OpenProcess CreateWaitableTimerExW QueryPerformanceFrequency CreateEventW CreateFileW SetUnhandledExceptionFilter LoadLibraryExA FreeLibrary GetLastError FormatMessageW FindNextFileW GetFileType GetFileAttributesW SetWaitableTimer GetConsoleOutputCP GetCurrentThreadId DeleteFileW VirtualQueryEx GetFinalPathNameByHandleW ReleaseMutex LoadLibraryExW CreateMutexA WaitForSingleObjectEx SwitchToThread ExitProcess FindClose FindFirstFileExW LoadLibraryW SetThreadErrorMode GetModuleFileNameW lstrlenW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GlobalLock GlobalSize GlobalUnlock GetStdHandle GetCurrentThread GetTickCount64 LocalFree GetConsoleMode WideCharToMultiByte SetConsoleMode CreateProcessW GetWindowsDirectoryW GlobalAlloc GlobalFree MultiByteToWideChar GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx CreateThread HeapReAlloc SetFileTime SetFileInformationByHandle GetFullPathNameW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal GetModuleHandleA Sleep GetConsoleScreenBufferInfo SetConsoleTextAttribute SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus SetHandleInformation GetCurrentProcessId DuplicateHandle GetCurrentProcess QueryPerformanceCounter LoadLibraryA HeapAlloc GetModuleHandleW GetCommandLineW GetSystemInfo WriteConsoleW

psapi

GetModuleFileNameExW GetModuleInformation GetModuleBaseNameA EnumProcessModules

ws2_32

getsockname freeaddrinfo WSACleanup WSAStartup recvfrom getpeername shutdown accept WSASend ioctlsocket connect WSAEnumNetworkEvents WSAEventSelect WSACreateEvent getsockopt recv send getaddrinfo sendto WSASocketW WSAGetLastError bind socket listen WSACloseEvent closesocket WSAIoctl setsockopt

gdi32

GdiFlush BitBlt SetPixelFormat ChoosePixelFormat CreateDIBSection SelectObject DeleteObject CreateRectRgn CreateCompatibleDC DescribePixelFormat GetDeviceCaps SwapBuffers DeleteDC

advapi32

ImpersonateAnonymousToken RevertToSelf SystemFunction036 RegOpenKeyExW GetLengthSid RegCloseKey CopySid IsValidSid GetTokenInformation OpenProcessToken RegQueryValueExW

secur32

DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext ApplyControlToken

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertDuplicateStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateChain CertOpenStore

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

ntdll

NtDeviceIoControlFile NtCreateFile NtCreateNamedPipeFile NtOpenFile NtWriteFile NtQueryInformationProcess NtQuerySystemInformation RtlGetVersion RtlNtStatusToDosError NtCancelIoFileEx NtReadFile

ole32

CoCreateInstance CoInitializeEx CoUninitialize OleInitialize RevokeDragDrop RegisterDragDrop

oleaut32

GetErrorInfo SetErrorInfo SysFreeString VariantClear SysStringLen SafeArrayPutElement SafeArrayCreateVector SysAllocStringLen

shell32

DragFinish DragQueryFileW CommandLineToArgvW

opengl32

wglDeleteContext wglGetCurrentDC wglGetCurrentContext wglMakeCurrent wglGetProcAddress wglShareLists wglCreateContext

shlwapi

AssocQueryStringW

uiautomationcore

UiaReturnRawElementProvider UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent UiaLookupId

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

bcrypt

BCryptGenRandom

vcruntime140

memcmp __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memmove memcpy memset

api-ms-win-crt-math-l1-1-0

cbrtf log10 fmod log2 __setusermatherr exp powf exp2f truncf log2f pow fmaf fma trunc roundf atan2f cosf sinf _hypotf tanf fmodf ceil _hypot round floorf ceilf cos sin expf acosf atanf floor

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment terminate _initterm _register_onexit_function _initterm_e exit _exit _seh_filter_exe _initialize_narrow_environment _configure_narrow_argv __p___argc _register_thread_local_exe_atexit_callback __p___argv _initialize_onexit_table strerror _c_exit _cexit _crt_atexit _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_d887fcd0621872c07debc552702dbf63_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

kernel32

psapi

ws2_32

gdi32

advapi32

secur32

crypt32

pdh

powrprof

ntdll

ole32

oleaut32

shell32

opengl32

shlwapi

uiautomationcore

imm32

dwmapi

uxtheme

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic