2026-10-23_4e1da195ac551cab25fd8efbb1246dc9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_4e1da195ac551cab25fd8efbb1246dc9_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 4.2MB
Sample261023-pp7xesbx21
SHA256 8d6c70e2acd8d20b4a5d6261857fb03ca52bff1d25b6b84c85e484c3f0d20e93
MD5 4e1da195ac551cab25fd8efbb1246dc9
SHA1 d972ece275f985a057187d99f3629b7c2698dd58
SHA512 5aaa687adc23194d3a829a84cef9cfbb11043e8f9188e527d7a07446b3b889dfcc24eddad21850746af2826fffb68793e4be5f2cbbcaa354207b65d48e8bb2fb
SSDEEP 49152:dT9Z9/pjXcB9Es7akZtRGKv0e7WdVxjkV39zxsGt/SU56ByhDFGX2:NNpj873WdU3am6ByhDFG
TLSH
T189161A27B5DAAEDCCD1AC470935F8F12596038CA0A6167A73984433B2FAB7E47D34E05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_4e1da195ac551cab25fd8efbb1246dc9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-23_4e1da195ac551cab25fd8efbb1246dc9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 4.2MB

2026-10-23_4e1da195ac551cab25fd8efbb1246dc9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 44536d642a8c40f2871bd156858d8966
SHA256 8d6c70e2acd8d20b4a5d6261857fb03ca52bff1d25b6b84c85e484c3f0d20e93
MD5 4e1da195ac551cab25fd8efbb1246dc9
SHA1 d972ece275f985a057187d99f3629b7c2698dd58
SHA512 5aaa687adc23194d3a829a84cef9cfbb11043e8f9188e527d7a07446b3b889dfcc24eddad21850746af2826fffb68793e4be5f2cbbcaa354207b65d48e8bb2fb
SSDEEP 49152:dT9Z9/pjXcB9Es7akZtRGKv0e7WdVxjkV39zxsGt/SU56ByhDFGX2:NNpj873WdU3am6ByhDFG
TLSH
T189161A27B5DAAEDCCD1AC470935F8F12596038CA0A6167A73984433B2FAB7E47D34E05
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2337692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d9_rth_crossref.pdb

bcryptprimitives

ProcessPrng

kernel32

GetModuleFileNameW FreeLibrary GetProcAddress TlsAlloc GetStdHandle CloseHandle GetCurrentProcess DuplicateHandle SwitchToThread GetCurrentProcessId WaitForSingleObjectEx CreateMutexA ReleaseMutex FlushFileBuffers GetLastError WaitForSingleObject SetThreadStackGuarantee GetCurrentThread SetLastError MoveFileExW SetFileInformationByHandle CreateDirectoryW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW GetModuleHandleA GetConsoleMode GetConsoleScreenBufferInfo WriteConsoleA GetCurrentProcessorNumber TlsFree TlsSetValue FindClose GetProcessTimes AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock WriteFile CancelIo GetExitCodeProcess WaitForMultipleObjects WriteFileEx SleepEx ReadFileEx CreateProcessW GetFileAttributesW CreateThread Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW GetFullPathNameW GetOverlappedResult CreateEventW ReadFile ExitProcess GetCurrentThreadId FormatMessageW InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleExA VirtualQuery VirtualFree VirtualAlloc GetEnvironmentVariableA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar QueryPerformanceFrequency SetUnhandledExceptionFilter GetModuleHandleW GetEnvironmentVariableW GetCurrentDirectoryW AddVectoredExceptionHandler LoadLibraryA WideCharToMultiByte lstrlenW MapViewOfFile CreateFileMappingW VirtualProtect UnmapViewOfFile GetSystemInfo QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtWriteFile NtOpenFile

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

vcruntime140

__CxxFrameHandler3 memset memcmp memmove _CxxThrowException __C_specific_handler __current_exception __current_exception_context memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

exp2 exp __setusermatherr log2 round log roundf logf ceil floor

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argc _errno exit _initialize_onexit_table _initterm_e _initterm _get_initial_narrow_environment _set_app_type _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe __p___argv _cexit _crt_atexit _c_exit terminate _register_thread_local_exe_atexit_callback _exit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

fputs __p__commode _set_fmode __acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_4e1da195ac551cab25fd8efbb1246dc9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic