2026-10-22_a0c07efb2e14d9b3ef56422b42b79a55_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_a0c07efb2e14d9b3ef56422b42b79a55_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar
Size 2.3MB
Sample261024-czkhnaea87
SHA256 2626711f72f5fdcd97719f7b20a326269e79ebd61b7e90736ed4360b27a4a2ea
MD5 a0c07efb2e14d9b3ef56422b42b79a55
SHA1 7917967311c63b3d3819dc855b7836e19c97e430
SHA512 74334d1c6e61c6f38a9f24c0bac0056d7c8b5cfc8e5e6f056f9ffdefcf400b711f7a4e868acd2e64c407dd0103e060e75c7acd2df32769061cbdb6164ecca434
SSDEEP 49152:FGOX0lp0LYkosBGJQbUnMkuj/fY///0eecuYIU6i:FGf0sfTB01n+
TLSH
T199B57D03FA9285E8C4DDC07883579732AB36F88D4A20B7EB2FD44A112E16F605F9D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_a0c07efb2e14d9b3ef56422b42b79a55_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

File Explorer

2026-10-22_a0c07efb2e14d9b3ef56422b42b79a55_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

.exe 2.3MB

2026-10-22_a0c07efb2e14d9b3ef56422b42b79a55_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

IMPHASH 8e08a4ff3bc080f0516fb97a501625ca
SHA256 2626711f72f5fdcd97719f7b20a326269e79ebd61b7e90736ed4360b27a4a2ea
MD5 a0c07efb2e14d9b3ef56422b42b79a55
SHA1 7917967311c63b3d3819dc855b7836e19c97e430
SHA512 74334d1c6e61c6f38a9f24c0bac0056d7c8b5cfc8e5e6f056f9ffdefcf400b711f7a4e868acd2e64c407dd0103e060e75c7acd2df32769061cbdb6164ecca434
SSDEEP 49152:FGOX0lp0LYkosBGJQbUnMkuj/fY///0eecuYIU6i:FGf0sfTB01n+
TLSH
T199B57D03FA9285E8C4DDC07883579732AB36F88D4A20B7EB2FD44A112E16F605F9D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1357836

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

emojiprint.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtWriteFile RtlNtStatusToDosError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtOpenFile NtCreateNamedPipeFile

kernel32

GlobalMemoryStatusEx IsProcessorFeaturePresent GetSystemTimePreciseAsFileTime QueryPerformanceFrequency QueryPerformanceCounter HeapAlloc K32GetPerformanceInfo TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId SleepEx CloseHandle SetLastError GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW GetCurrentDirectoryW GetCurrentProcessId CreateMutexA WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW ReleaseMutex WideCharToMultiByte GetEnvironmentVariableW GetModuleHandleA GetModuleHandleW FormatMessageW GetTempPathW GetFullPathNameW CreateFileW SetFileInformationByHandle SetHandleInformation CompareStringOrdinal GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateThread ReadFileEx WriteFileEx

pdh

PdhRemoveCounter PdhCloseQuery

ws2_32

ioctlsocket setsockopt getsockname WSARecv WSASocketW WSAGetLastError getaddrinfo WSACleanup WSAStartup send WSASend getpeername freeaddrinfo connect select getsockopt WSADuplicateSocketW recv closesocket

vcruntime140

__current_exception memcpy __CxxFrameHandler3 memcmp memmove __current_exception_context __C_specific_handler memset

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table __p___argv __p___argc _set_app_type _exit terminate _configure_narrow_argv _cexit _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _initterm _initterm_e _seh_filter_exe exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_a0c07efb2e14d9b3ef56422b42b79a55_akira_cobalt-strike_glassworm_rusty-stealer_satacom_vidar

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

ntdll

kernel32

pdh

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic