2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 13.0MB
Sample261024-l38jbshs2w
SHA256 f955ac01734ef6b4b8f9c7ae259c32ab5ce7f4a69bc23dc7aa77ddcd7727515a
MD5 69500938f2ae29e2f95d5401fe9ed125
SHA1 f2c87e3faea6920ca8a79ede226e96e4af509c80
SHA512 4cb1c889e45586bc5f8122da773113b25e3a456958ac02aa235669914023bf4f9edae460f57805ea2330c051f3c95d8ad6b40ba70a73b294ff107776b98d1d1f
SSDEEP 98304:q9fW1/nEVQ9GNRCMZ1ZABVdD74rjVOnJE84737JRLmOJTy:OW1/nGQMNeQrj2yHJRLZJ+
TLSH
T130D639257B4AD4EDC56AC0B097468A726E72B0DE0F35BAFB45C486383E249F41E3D784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

File Explorer

2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

.exe 13.0MB

2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

IMPHASH ce7e2742f5d2d8095cc62b101ee4a661
SHA256 f955ac01734ef6b4b8f9c7ae259c32ab5ce7f4a69bc23dc7aa77ddcd7727515a
MD5 69500938f2ae29e2f95d5401fe9ed125
SHA1 f2c87e3faea6920ca8a79ede226e96e4af509c80
SHA512 4cb1c889e45586bc5f8122da773113b25e3a456958ac02aa235669914023bf4f9edae460f57805ea2330c051f3c95d8ad6b40ba70a73b294ff107776b98d1d1f
SSDEEP 98304:q9fW1/nEVQ9GNRCMZ1ZABVdD74rjVOnJE84737JRLmOJTy:OW1/nGQMNeQrj2yHJRLZJ+
TLSH
T130D639257B4AD4EDC56AC0B097468A726E72B0DE0F35BAFB45C486383E249F41E3D784
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7053596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SignalRgbService.pdb

kernel32

lstrlenW WaitForSingleObjectEx LoadLibraryA CreateMutexA GetModuleHandleA VirtualQuery GetSystemInfo LoadLibraryExW GetCurrentProcess WaitForSingleObject CreateEventW FormatMessageW GetLastError FreeLibrary GetProcAddress LoadLibraryExA OpenProcess ReadProcessMemory HeapAlloc GetProcessIoCounters GetSystemTimes HeapFree GetSystemTimeAsFileTime RtlVirtualUnwind GetProcessHeap GetComputerNameExW GetExitCodeProcess IsDebuggerPresent UnhandledExceptionFilter GetProcessTimes CreateFileW K32GetPerformanceInfo GlobalMemoryStatusEx GetModuleHandleW RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle CloseHandle ProcessIdToSessionId GetCurrentProcessId SetUnhandledExceptionFilter WideCharToMultiByte ReleaseMutex LocalFree InitializeSListHead IsProcessorFeaturePresent SetHandleInformation GetNativeSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal GetFileAttributesW FreeEnvironmentStringsW PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx CreateThread GetOverlappedResult ReadFile SetFileCompletionNotificationModes Sleep VirtualQueryEx GetConsoleMode HeapReAlloc GetConsoleOutputCP SetFileInformationByHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetStdHandle WriteConsoleW MultiByteToWideChar SwitchToThread GetFinalPathNameByHandleW CancelIo QueryPerformanceFrequency GetFullPathNameW GetCurrentThreadId GetModuleFileNameW ExitProcess WaitForMultipleObjects ReadFileEx SleepEx

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

ws2_32

WSASend setsockopt getsockname ioctlsocket connect WSAIoctl WSASocketW bind listen getpeername accept shutdown socket WSAGetLastError getaddrinfo recv freeaddrinfo WSAStartup WSACleanup getsockopt closesocket send

advapi32

RegOpenKeyExW GetLengthSid RegQueryValueExW RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW OpenSCManagerW OpenServiceW IsValidSid ControlService SetServiceStatus RegCloseKey CloseServiceHandle SystemFunction036 CopySid OpenProcessToken GetTokenInformation

pdh

PdhCollectQueryData PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhRemoveCounter PdhCloseQuery PdhOpenQueryA

powrprof

CallNtPowerInformation

secur32

QueryContextAttributesW AcquireCredentialsHandleA DeleteSecurityContext FreeCredentialsHandle EncryptMessage FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext DecryptMessage ApplyControlToken

oleaut32

SysStringLen SysFreeString GetErrorInfo

ntdll

NtCreateFile RtlNtStatusToDosError RtlGetVersion NtCancelIoFileEx NtWriteFile NtOpenFile NtReadFile NtCreateNamedPipeFile NtDeviceIoControlFile NtQuerySystemInformation NtQueryInformationProcess

shell32

CommandLineToArgvW

user32

GetSystemMetrics

crypt32

CertDuplicateCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CertCloseStore CertDuplicateStore CertOpenStore CertFreeCertificateContext CertDuplicateCertificateContext CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain

bcrypt

BCryptGenRandom

psapi

GetModuleInformation EnumProcessModules GetProcessMemoryInfo GetModuleFileNameExW

vcruntime140

__current_exception_context __current_exception __C_specific_handler memset __CxxFrameHandler3 _CxxThrowException memcpy memcmp memmove

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-math-l1-1-0

pow ceil __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _seh_filter_exe _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _configure_narrow_argv _initialize_narrow_environment terminate _get_initial_narrow_environment _initterm _initterm_e exit _register_onexit_function _exit __p___argc _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

395KB

Virtual Size

395KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_69500938f2ae29e2f95d5401fe9ed125_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ws2_32

advapi32

pdh

powrprof

secur32

oleaut32

ntdll

shell32

user32

crypt32

bcrypt

psapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic