2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 3.7MB
Sample261024-1kssgset3r
SHA256 cbc7daf17c4feded3d25c3116e0c27ceda94268d1eb73ba65299b4fdd9d83ef6
MD5 0f6788dd4e3684dc85cdd2f798f7265a
SHA1 a192e60123a16fc550d1c5a3cbdbea6bc6d41f5b
SHA512 3d129cd78b1301432b4435999eb716b4753d5fdc419bdf9ce6d46e724a935c9e7a575a377e080cc93ddc53a765b1fec5089ede38e17790559d4007e3549e5ac4
SSDEEP 49152:nNzNNiQGTaIQHkHOAPbAQMtIpcMuvuu0w9Is9BPV6QiOFs/Xk:FbivWCOMfb38BDM8
TLSH
T17A063B02BE8A55E8C099C870C38B85739E2174DF1A36B5BF558A51353FBABB45F2C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 3.7MB

2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH 572845f8522c88ab534b9f109c03f6fa
SHA256 cbc7daf17c4feded3d25c3116e0c27ceda94268d1eb73ba65299b4fdd9d83ef6
MD5 0f6788dd4e3684dc85cdd2f798f7265a
SHA1 a192e60123a16fc550d1c5a3cbdbea6bc6d41f5b
SHA512 3d129cd78b1301432b4435999eb716b4753d5fdc419bdf9ce6d46e724a935c9e7a575a377e080cc93ddc53a765b1fec5089ede38e17790559d4007e3549e5ac4
SSDEEP 49152:nNzNNiQGTaIQHkHOAPbAQMtIpcMuvuu0w9Is9BPV6QiOFs/Xk:FbivWCOMfb38BDM8
TLSH
T17A063B02BE8A55E8C099C870C38B85739E2174DF1A36B5BF558A51353FBABB45F2C318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c9:12:f6:62:cf:a1:ff:6f:2c:8e:f0:8d:60:a1:07:d6:2d:95:a9:ba:33:2a:f7:aa:c5:17:a2:d6:bf:16:a3:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=El Azab Olivier,O=El Azab Olivier,ST=Occitanie,C=FR

Chains

Oct 20, 2026

CN=El Azab Olivier,O=El Azab Olivier,ST=Occitanie,C=FR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=El Azab Olivier,O=El Azab Olivier,ST=Occitanie,C=FR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=El Azab Olivier,O=El Azab Olivier,ST=Occitanie,C=FR

Serial Number

4a:7d:05:f4:b7:79:49:21:af:0d:8c:ed:e8:e1:ea:09

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 3, 2026

Timespan

Mar 3, 2026 - Jun 1, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

2733696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clouddesk_agent.pdb

wintrust

CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext CryptCATAdminEnumCatalogFromHash WinVerifyTrust CryptCATAdminAcquireContext WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

crypt32

CryptUnprotectData CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateChain CertEnumCertificatesInStore CertDuplicateStore CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateContext CertCloseStore CertFreeCertificateContext CryptProtectData CertGetNameStringW

ntdll

RtlPcToFileHeader RtlUnwindEx NtQueryInformationProcess RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile NtQuerySystemInformation NtQueryObject RtlGetVersion

kernel32

SwitchToThread CompareStringW LoadLibraryExW VirtualProtect LCMapStringW WriteFile GetStringTypeW SetEnvironmentVariableW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW OpenProcess TerminateProcess Process32NextW GetCPInfo PeekNamedPipe ReadFile GetModuleHandleW GetProcAddress GetOEMCP GetACP DuplicateHandle LoadLibraryW GetTickCount64 SetHandleInformation LocalFree SetLastError UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCurrentThreadId GetCommandLineA GetModuleHandleExW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue CreateFileW FlsGetValue WTSGetActiveConsoleSessionId WriteConsoleW FlsAlloc GetConsoleOutputCP RaiseException GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime SetStdHandle CreateDirectoryW WaitForMultipleObjects ReleaseMutex GlobalLock GlobalUnlock FlushFileBuffers AddVectoredExceptionHandler GlobalAlloc HeapSize GetSystemTimePreciseAsFileTime HeapReAlloc FreeLibrary AllocConsole AttachConsole CloseHandle SetConsoleTextAttribute LoadLibraryExA FindVolumeClose FindNextVolumeW FindFirstVolumeW GetSystemTimes GetFinalPathNameByHandleW GetExitCodeProcess DeviceIoControl CreateProcessW GetWindowsDirectoryW GetVolumePathNamesForVolumeNameW GetSystemDirectoryW GetConsoleScreenBufferInfo GetLastError SetConsoleMode ProcessIdToSessionId DisconnectNamedPipe GetCurrentProcess GetConsoleMode GetStdHandle ConnectNamedPipe SetFilePointerEx CreateNamedPipeW SetThreadStackGuarantee GetCurrentThread GetVolumeInformationW GetCurrentDirectoryW GetDriveTypeW ReadProcessMemory GetEnvironmentVariableW GetCommandLineW VirtualQueryEx GetComputerNameExW K32GetPerformanceInfo FreeEnvironmentStringsW GetEnvironmentStringsW lstrlenW FindClose GetProcessTimes CopyFileExW GlobalMemoryStatusEx GetProcessHandleCount IsWow64Process FindFirstFileExW ExitProcess WideCharToMultiByte WaitForSingleObjectEx GetNativeSystemInfo GetProcessIoCounters HeapFree GetProcessHeap Module32FirstW Module32NextW MoveFileExW GetDiskFreeSpaceExW WaitForSingleObject LoadLibraryA QueryFullProcessImageNameW SetPriorityClass GetTimeZoneInformationForYear IsValidCodePage GetSystemInfo FindNextFileW CancelIo GetModuleHandleA FormatMessageW CompareStringOrdinal WriteFileEx SleepEx GetFullPathNameW GetFileType GetFileAttributesW QueryPerformanceFrequency QueryPerformanceCounter Sleep SetWaitableTimer CreateThread CreateWaitableTimerExW MultiByteToWideChar GetModuleFileNameW HeapAlloc DeleteFileW ReadFileEx CreateEventW GetOverlappedResult SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateMutexA

oleaut32

VariantClear SysFreeString GetErrorInfo SysStringLen

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

advapi32

IsValidSid GetLengthSid CopySid GetSidSubAuthority GetSidSubAuthorityCount LookupAccountSidW CloseServiceHandle RegDeleteValueW GetTokenInformation CreateProcessAsUserW SetTokenInformation DuplicateTokenEx ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSetValueExW RegCreateKeyExW QueryServiceStatusEx ControlService DeleteService CreateServiceW SetServiceStatus RegCloseKey RegQueryValueExW RegOpenKeyExW SystemFunction036 RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW StartServiceW ChangeServiceConfig2W OpenSCManagerW OpenServiceW

user32

CreateWindowExW EnumDisplayMonitors SetCursorPos MapVirtualKeyW keybd_event mouse_event GetSystemMetrics LoadIconW LoadImageW GetMonitorInfoW CloseDesktop SetThreadDesktop DispatchMessageA PeekMessageA GetUserObjectInformationW SetTimer SetLayeredWindowAttributes UpdateWindow SetForegroundWindow GetMessageW SetClipboardData EmptyClipboard CloseClipboard OpenInputDesktop SetProcessDPIAware RegisterClassExW TranslateMessage MessageBoxW GetClipboardData ReleaseDC DispatchMessageW GetDC UnregisterClassW OpenClipboard SystemParametersInfoW HideCaret GetForegroundWindow KillTimer InvalidateRect SendInput SendMessageA PostThreadMessageW RegisterWindowMessageW ShowCursor BlockInput ShowWindow DefWindowProcW EndPaint DrawTextW GetClientRect SetWindowPos BeginPaint DestroyWindow

gdi32

CreateCompatibleBitmap GetStockObject CreateCompatibleDC SetBkMode BitBlt PatBlt SelectObject SetTextColor DeleteDC DeleteObject GetDIBits

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

secur32

FreeContextBuffer EncryptMessage DecryptMessage AcquireCredentialsHandleA InitializeSecurityContextW DeleteSecurityContext QueryContextAttributesW AcceptSecurityContext FreeCredentialsHandle

ws2_32

WSAStartup getsockname WSASocketW select closesocket setsockopt WSAIoctl connect freeaddrinfo bind WSACleanup sendto getaddrinfo WSAGetLastError recv send getsockopt ioctlsocket

shell32

ShellExecuteW CommandLineToArgvW Shell_NotifyIconW

winmm

timeEndPeriod timeBeginPeriod

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

mfplat

MFTEnumEx MFStartup MFCreateSample MFCreateMemoryBuffer MFCreateMediaType MFShutdown

ole32

CoInitializeEx CoTaskMemFree

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

psapi

GetProcessMemoryInfo GetModuleFileNameExW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable GetAdaptersAddresses

bcrypt

BCryptGenRandom

pdh

PdhOpenQueryA PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter PdhCollectQueryData

powrprof

CallNtPowerInformation

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

898KB

Virtual Size

897KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

PE Signature issue

wintrust

crypt32

ntdll

kernel32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

user32

gdi32

dxgi

d3d11

secur32

ws2_32

shell32

winmm

wtsapi32

mfplat

ole32

userenv

psapi

version

iphlpapi

bcrypt

pdh

powrprof

generic