2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 23.6MB
Sample261024-ec1mgafw3s
SHA256 63bec8a611ecf6b52e05bba860927e0fb857487c461226832a276c6b145a5460
MD5 9799722c3a79cd884a8f4342e611dd94
SHA1 1fc6280aef17ac021373f9df64f36c4894d0d2ea
SHA512 8cc43fed4f2ae4e42761f5ef3992ca70a8b330cc1228868e17022b2b50167888f590cd757cc3adefd7d1290832fe6d63f7c5dc810a720d1921ea5d87a2a64d8f
SSDEEP 196608:Kg8AvR4UFUVTHUL5t6cAe4ZXGJyIYcypIIeCeNz:HtJ4UFUVTHUvLn6X3Ne
TLSH
T1F94729166679A0D9D1BBC0B8D2838F22BD2174D947393BF745D0826A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 23.6MB

2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 79732d836439a302ee2c548076f23e70
SHA256 63bec8a611ecf6b52e05bba860927e0fb857487c461226832a276c6b145a5460
MD5 9799722c3a79cd884a8f4342e611dd94
SHA1 1fc6280aef17ac021373f9df64f36c4894d0d2ea
SHA512 8cc43fed4f2ae4e42761f5ef3992ca70a8b330cc1228868e17022b2b50167888f590cd757cc3adefd7d1290832fe6d63f7c5dc810a720d1921ea5d87a2a64d8f
SSDEEP 196608:Kg8AvR4UFUVTHUL5t6cAe4ZXGJyIYcypIIeCeNz:HtJ4UFUVTHUvLn6X3Ne
TLSH
T1F94729166679A0D9D1BBC0B8D2838F22BD2174D947393BF745D0826A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12759712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

asterfall_client-664e572ad997b8e5.pdb

kernel32

MoveFileExW FlsSetValue FlsGetValue FlsAlloc LoadLibraryExW GetModuleFileNameW GetFileAttributesW SetThreadErrorMode FreeLibrary GetProcAddress GetCurrentProcess GetCurrentProcessId SetHandleInformation CloseHandle GetFileInformationByHandle GetShortPathNameW ConnectNamedPipe SetFileCompletionNotificationModes RemoveDllDirectory LocalFree CreateNamedPipeW AddDllDirectory CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx ReadFile GetOverlappedResult GetSystemTimeAsFileTime GetLastError GetSystemDirectoryW GetCurrentThreadId GlobalMemoryStatusEx InitializeSListHead FindNextFileW GetTempPathW GetModuleHandleA WaitForMultipleObjects FormatMessageW GetModuleHandleW GetFileType Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar HeapAlloc SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess CreateHardLinkW FindClose FindFirstFileExW RemoveDirectoryW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW SetUnhandledExceptionFilter GetProcessId GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle FlushFileBuffers ReadFileEx CreateEventW CreateThread HeapReAlloc HeapFree GetProcessHeap SetFileTime CreateFileW SetFileInformationByHandle GetFullPathNameW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW WaitForSingleObject CompareStringOrdinal RtlVirtualUnwind GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW OpenProcessToken GetTokenInformation SystemFunction036 RegGetValueW

user32

IsHungAppWindow GetSystemMetrics GetForegroundWindow GetWindowThreadProcessId IsWindowVisible EnumThreadWindows GetGUIThreadInfo MapVirtualKeyW GetKeyState GetCurrentInputMessageSource

ws2_32

WSARecv WSASend ioctlsocket WSAIoctl bind getsockname send accept listen WSASocketW connect shutdown WSAGetLastError getpeername setsockopt getsockopt closesocket recv freeaddrinfo select WSAStartup WSACleanup getaddrinfo

ntdll

NtOpenFile NtWriteFile NtReadFile RtlDllShutdownInProgress NtCancelIoFileEx NtDeviceIoControlFile RtlNtStatusToDosError NtCreateFile NtCreateNamedPipeFile

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcmp memmove memset _CxxThrowException __current_exception_context __current_exception memcpy __C_specific_handler

api-ms-win-crt-math-l1-1-0

floor fmod __setusermatherr pow

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _get_initial_narrow_environment _cexit _initialize_narrow_environment _exit _crt_atexit _configure_narrow_argv _initialize_onexit_table _set_app_type _seh_filter_exe __p___argc exit _c_exit _register_thread_local_exe_atexit_callback __p___argv terminate _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9799722c3a79cd884a8f4342e611dd94_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

user32

ws2_32

ntdll

bcryptprimitives

bcrypt

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic