2026-10-23_550a8f2a6fa57856059f574832ff34e9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_550a8f2a6fa57856059f574832ff34e9_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 15.8MB
Sample261023-pc5ljaxyft
SHA256 c4ee858f67cbe174dcfb4dcf3481acead238594ee85594ce6af783131ad01ae4
MD5 550a8f2a6fa57856059f574832ff34e9
SHA1 61927c820cc0a8607665a15d803e7807adbe2191
SHA512 dd44d3d4b4190677472ef7eee85e4cec43573388c9ca6a7fbe85543d3e5d88c9a8be556be4ac7fab96eaf29c180f3fb48c1c3cce5de031f4d09d636e83fdc0ab
SSDEEP 98304:a1KW2MhyisIP/QOAZLP4PAnOXGWjHbBr2oEHSJ7DtS1+9QxaTikitXFbq5EF5kvn:cKYhtHrqGr2oEHSJUyidME/Yn
TLSH
T120F6C72A2778A4E9C17BC079D1838F61692170EA0F352BE34491827A2F35DFD6E3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_550a8f2a6fa57856059f574832ff34e9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-23_550a8f2a6fa57856059f574832ff34e9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 15.8MB

2026-10-23_550a8f2a6fa57856059f574832ff34e9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH edb278e4a37d77f565212a1c8473a97d
SHA256 c4ee858f67cbe174dcfb4dcf3481acead238594ee85594ce6af783131ad01ae4
MD5 550a8f2a6fa57856059f574832ff34e9
SHA1 61927c820cc0a8607665a15d803e7807adbe2191
SHA512 dd44d3d4b4190677472ef7eee85e4cec43573388c9ca6a7fbe85543d3e5d88c9a8be556be4ac7fab96eaf29c180f3fb48c1c3cce5de031f4d09d636e83fdc0ab
SSDEEP 98304:a1KW2MhyisIP/QOAZLP4PAnOXGWjHbBr2oEHSJ7DtS1+9QxaTikitXFbq5EF5kvn:cKYhtHrqGr2oEHSJUyidME/Yn
TLSH
T120F6C72A2778A4E9C17BC079D1838F61692170EA0F352BE34491827A2F35DFD6E3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11496608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mv_model_manager-320bbee5dcfb2d61.pdb

dxgi

CreateDXGIFactory1

kernel32

AddVectoredExceptionHandler CancelIo CancelIoEx CloseHandle CompareStringOrdinal CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetShortPathNameW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetVolumePathNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitializeSListHead K32GetPerformanceInfo LoadLibraryA LocalFree MoveFileExW MultiByteToWideChar OpenProcess PostQueuedCompletionStatus Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReadFileEx ReadProcessMemory ReleaseMutex RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleTextAttribute SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetNamedPipeHandleState SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhEnumObjectsW PdhGetFormattedCounterValue PdhOpenQueryW PdhRemoveCounter

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken SystemFunction036

psapi

GetModuleFileNameExW GetProcessMemoryInfo

powrprof

CallNtPowerInformation

shell32

CommandLineToArgvW

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

oleaut32

GetErrorInfo

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv send setsockopt shutdown

userenv

GetUserProfileDirectoryW

bcrypt

BCryptGenRandom

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr floor fmod pow

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

wcslen

Name

.text

Size

11.0MB

Virtual Size

11.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

545B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_550a8f2a6fa57856059f574832ff34e9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

dxgi

kernel32

api-ms-win-core-synch-l1-2-0

pdh

advapi32

psapi

powrprof

shell32

ntdll

bcryptprimitives

oleaut32

ws2_32

userenv

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic