2026-10-22_aae4fc284267726aa5066b2d2a0f1c1c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_aae4fc284267726aa5066b2d2a0f1c1c_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 6.0MB
Sample261024-bf8kpsez3w
SHA256 5c87f49cfdded499eb7ea0d6f6eb26f1369da68b3af5addd895f7fe6e3813257
MD5 aae4fc284267726aa5066b2d2a0f1c1c
SHA1 8c572961bd08a8844a5de6e8949a61bbeb5a6874
SHA512 474930e27fd6d2f403a73151f45e87e6b1337207f38643caff9d2325f3932e09fb93ad2cf9b9fd20be8b923141c60eacc9787259fa8724956af6c0d117c36a7d
SSDEEP 49152:jyNdeE0OM3mGfKN/pt1qPYkY4hHaDaeMz5AzWugONRKDEGrtYo1Y9G8Tmylu+Z2I:1fBdRRvtjE+YJM
TLSH
T19956D816A67960D9D17FC078D2879F22BD21749907393BF789D0826A2F24EF8AD3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_aae4fc284267726aa5066b2d2a0f1c1c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-22_aae4fc284267726aa5066b2d2a0f1c1c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 6.0MB

2026-10-22_aae4fc284267726aa5066b2d2a0f1c1c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH b4aaba0c31b209503eb28f90a1bc4a9d
SHA256 5c87f49cfdded499eb7ea0d6f6eb26f1369da68b3af5addd895f7fe6e3813257
MD5 aae4fc284267726aa5066b2d2a0f1c1c
SHA1 8c572961bd08a8844a5de6e8949a61bbeb5a6874
SHA512 474930e27fd6d2f403a73151f45e87e6b1337207f38643caff9d2325f3932e09fb93ad2cf9b9fd20be8b923141c60eacc9787259fa8724956af6c0d117c36a7d
SSDEEP 49152:jyNdeE0OM3mGfKN/pt1qPYkY4hHaDaeMz5AzWugONRKDEGrtYo1Y9G8Tmylu+Z2I:1fBdRRvtjE+YJM
TLSH
T19956D816A67960D9D17FC078D2879F22BD21749907393BF789D0826A2F24EF8AD3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4558144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

asterfall_smoke_setup.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

GetSystemTimeAsFileTime SetUnhandledExceptionFilter FindNextFileW InitializeSListHead CloseHandle RtlVirtualUnwind GetLastError WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetModuleHandleW FormatMessageW GetModuleFileNameW GetModuleHandleA

ntdll

NtWriteFile NtOpenFile RtlNtStatusToDosError NtReadFile

ws2_32

closesocket getaddrinfo WSAGetLastError setsockopt getsockopt ioctlsocket recv getpeername connect select send WSASocketW freeaddrinfo WSAStartup WSACleanup

vcruntime140

memset __CxxFrameHandler3 __current_exception __C_specific_handler _CxxThrowException __current_exception_context memcpy memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type terminate _crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _register_onexit_function _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _cexit _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_aae4fc284267726aa5066b2d2a0f1c1c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic