2026-10-22_0ddc85adb756e69f1750ee32aaf7fdea_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_0ddc85adb756e69f1750ee32aaf7fdea_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 21.7MB
Sample261024-1rnr4sxtas
SHA256 bfd06362a11ec6b9e1aec5d44e10a30c977283083cdff6202c4d3ecaa057ebbb
MD5 0ddc85adb756e69f1750ee32aaf7fdea
SHA1 d29c467af9b73adbfd4f3317a2778eed52d0bd95
SHA512 f3f0b956ade54896814ceb8a98805ffa0a7070aaab9802b3ce2652796c190f47977b6b6ab609096f568668ceb73cfc95a9810c91b34c65571a190464cd95f59b
SSDEEP 98304:TnWC69xy9GGJnH0tLAJqO/yjbT+XCl8aQ7mtu1+Tt1dbxJa8UM4pNpw17iv2xZpX:TnWvcJuLAJT+Cr7ANOfdxo
TLSH
T1BC37D62A667964D9D17BC0B8D2878F22BE2170D907392BF345D1827A2F24EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_0ddc85adb756e69f1750ee32aaf7fdea_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-22_0ddc85adb756e69f1750ee32aaf7fdea_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 21.7MB

2026-10-22_0ddc85adb756e69f1750ee32aaf7fdea_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 65f1530614c7b669846a68a55c878263
SHA256 bfd06362a11ec6b9e1aec5d44e10a30c977283083cdff6202c4d3ecaa057ebbb
MD5 0ddc85adb756e69f1750ee32aaf7fdea
SHA1 d29c467af9b73adbfd4f3317a2778eed52d0bd95
SHA512 f3f0b956ade54896814ceb8a98805ffa0a7070aaab9802b3ce2652796c190f47977b6b6ab609096f568668ceb73cfc95a9810c91b34c65571a190464cd95f59b
SSDEEP 98304:TnWC69xy9GGJnH0tLAJqO/yjbT+XCl8aQ7mtu1+Tt1dbxJa8UM4pNpw17iv2xZpX:TnWvcJuLAJT+Cr7ANOfdxo
TLSH
T1BC37D62A667964D9D17BC0B8D2878F22BE2170D907392BF345D1827A2F24EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16574416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

asterfall_launcher_core-a8a44cb9054d54df.pdb

advapi32

RegSetValueExW GetNamedSecurityInfoW ConvertSecurityDescriptorToStringSecurityDescriptorW RegDeleteTreeW RegQueryValueExW RegOpenKeyExW RegGetValueW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation ConvertSidToStringSidW SystemFunction036 RegCloseKey RegCreateKeyExW

ntdll

NtCreateFile NtCreateNamedPipeFile NtOpenFile NtWriteFile NtReadFile RtlGetVersion NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError

kernel32

SetFileCompletionNotificationModes FreeLibrary GetLastError CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateEventW GetProcAddress SetNamedPipeHandleState GetCurrentProcess GetSystemTimeAsFileTime CreateNamedPipeW lstrlenW WriteFile CloseHandle ReOpenFile SetFileAttributesW GetNamedPipeHandleStateW GetNamedPipeInfo DeviceIoControl Process32NextW Process32FirstW CreateToolhelp32Snapshot SetHandleInformation CreateFileW GetNamedPipeClientProcessId FormatMessageW ConnectNamedPipe ReleaseMutex ReadFile GetFileInformationByHandleEx HeapAlloc HeapFree GetProcessHeap SetFileInformationByHandle LoadLibraryExA CancelIoEx LoadLibraryExW GetConsoleScreenBufferInfo GetModuleHandleW DuplicateHandle SetConsoleTextAttribute GetStdHandle LockFileEx GetOverlappedResult CreateMutexW GetSystemDirectoryW LocalFree OpenProcess GetExitCodeProcess WaitForSingleObject QueryFullProcessImageNameW GetHandleInformation GlobalMemoryStatusEx MoveFileExW SetUnhandledExceptionFilter InitializeSListHead RtlVirtualUnwind CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter FindNextFileW GetTempPathW GetModuleHandleA WaitForMultipleObjects CreateThread GetModuleFileNameW GetFileType GetCurrentProcessId ReadFileEx FlushFileBuffers RtlCaptureContext GetFileAttributesW Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar ReadConsoleW DeleteFileW CreateSymbolicLinkW GetFinalPathNameByHandleW CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW CopyFileExW RemoveDirectoryW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW TerminateProcess GetProcessId CreateProcessW GetWindowsDirectoryW GetEnvironmentStringsW GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry

ole32

CoUninitialize CoInitializeEx CoCreateInstance

shell32

ShellExecuteExW SHGetKnownFolderPath

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

oleaut32

SysStringLen SysFreeString GetErrorInfo

bcryptprimitives

ProcessPrng

wintrust

WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

crypt32

CertDuplicateCertificateContext CertDuplicateCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertGetNameStringW CertCreateCertificateChainEngine CertDuplicateStore CryptProtectData CertVerifyCertificateChainPolicy CertAddEncodedCertificateToStore CertOpenStore CertGetCertificateChain CertSetCertificateContextProperty CertCloseStore CertFreeCertificateContext CertFreeCertificateChain CertFreeCertificateChainEngine CryptUnprotectData

combase

CoTaskMemFree

secur32

FreeCredentialsHandle EncryptMessage DecryptMessage FreeContextBuffer AcceptSecurityContext DeleteSecurityContext InitializeSecurityContextW ApplyControlToken AcquireCredentialsHandleA QueryContextAttributesW

bcrypt

BCryptGenRandom

ws2_32

connect WSASocketW listen accept send recv bind WSAIoctl WSASend ioctlsocket getsockname getpeername setsockopt getsockopt closesocket shutdown WSAGetLastError getaddrinfo WSACleanup WSAStartup freeaddrinfo WSARecv

userenv

GetUserProfileDirectoryW

vcruntime140

__C_specific_handler __current_exception __current_exception_context __CxxFrameHandler3 memcpy memcmp memset memmove _CxxThrowException

api-ms-win-crt-math-l1-1-0

floor fmod pow ceil __setusermatherr log2

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

exit _exit __p___argc _initterm_e _initterm __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _seh_filter_exe _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0ddc85adb756e69f1750ee32aaf7fdea_akira_cobalt-strike_glassworm_rusty-stealer_satacom

advapi32

ntdll

kernel32

ole32

shell32

api-ms-win-core-synch-l1-2-0

oleaut32

bcryptprimitives

wintrust

crypt32

combase

secur32

bcrypt

ws2_32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic