2026-10-22_3083f26ca71f890b4d047a1219ae480c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_3083f26ca71f890b4d047a1219ae480c_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 7.0MB
Sample261024-v42xlsbt2x
SHA256 00158bff8c2c286ca6f177a20526d32357dcff35db4e7dde1ae8b8f3e0215997
MD5 3083f26ca71f890b4d047a1219ae480c
SHA1 71897a803ee619d95ca13ad6be49557872bda211
SHA512 17fef689be79d4f8899a504b85d22ea0c0af95290949c2d7a6966b15e34b6ad4cf0cc51b0af41d55a2dd7f22e12b31face2e415d4120dc00e67d826d3fba214b
SSDEEP 98304:Y6/C3AV4NevckmGMfrSt5YtAW2Fo2lvFW2+gK/BPMArJdLXxYsUBFX:+3e8cW2+FBPMezq
TLSH
T15C768C03F781C1E9C0AEC0B8C35BA637EB71B8894525B29F5BE44B612E26F506F1D359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_3083f26ca71f890b4d047a1219ae480c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-22_3083f26ca71f890b4d047a1219ae480c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 7.0MB

2026-10-22_3083f26ca71f890b4d047a1219ae480c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 2df26648cad8765d4aa024f762cb068a
SHA256 00158bff8c2c286ca6f177a20526d32357dcff35db4e7dde1ae8b8f3e0215997
MD5 3083f26ca71f890b4d047a1219ae480c
SHA1 71897a803ee619d95ca13ad6be49557872bda211
SHA512 17fef689be79d4f8899a504b85d22ea0c0af95290949c2d7a6966b15e34b6ad4cf0cc51b0af41d55a2dd7f22e12b31face2e415d4120dc00e67d826d3fba214b
SSDEEP 98304:Y6/C3AV4NevckmGMfrSt5YtAW2Fo2lvFW2+gK/BPMArJdLXxYsUBFX:+3e8cW2+FBPMezq
TLSH
T15C768C03F781C1E9C0AEC0B8C35BA637EB71B8894525B29F5BE44B612E26F506F1D359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4387468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RyuuManifestToolV2.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateFile NtDeviceIoControlFile NtWriteFile NtReadFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError RtlGetVersion NtOpenFile

kernel32

LoadLibraryW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLastError GlobalLock GlobalUnlock RaiseException GetModuleHandleW lstrlenW FormatMessageW WideCharToMultiByte FlsAlloc CloseHandle GlobalAlloc FlsGetValue Sleep FlsSetValue SetLastError FlsFree EncodePointer HeapReAlloc HeapFree GetProcAddress LoadLibraryA GetProcessHeap GetCurrentThread GetTimeZoneInformationForYear SetThreadStackGuarantee LCIDToLocaleName GetUserDefaultUILanguage GetModuleHandleA GetSystemInfo MultiByteToWideChar WaitForMultipleObjects DuplicateHandle GetWindowsDirectoryW GetSystemDirectoryW GetCurrentThreadId GetExitCodeProcess ExitProcess SetWaitableTimer WaitForSingleObject GetSystemTimePreciseAsFileTime GetModuleFileNameW HeapAlloc RtlLookupFunctionEntry ReleaseMutex LoadLibraryExA GetCurrentProcessId GetProcessId SetHandleInformation GetCurrentProcess WaitForSingleObjectEx OutputDebugStringA OutputDebugStringW LoadLibraryExW GlobalFree FreeLibrary RtlPcToFileHeader SleepEx SwitchToThread CompareStringOrdinal GlobalSize RtlUnwindEx InitializeSListHead SetUnhandledExceptionFilter AddVectoredExceptionHandler GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetFileInformationByHandleEx SetFileInformationByHandle FindClose CopyFileExW DeviceIoControl ReadFileEx WriteFileEx SetEnvironmentVariableW GetCommandLineW RemoveDirectoryW MoveFileExW InitializeCriticalSectionEx GetConsoleMode GetConsoleOutputCP WriteConsoleW RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW CreateMutexA GetEnvironmentVariableW CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW GetFileInformationByHandle SetFilePointerEx GetTempPathW DeleteFileW GetFinalPathNameByHandleW QueryPerformanceFrequency CreateThread QueryPerformanceCounter CreateWaitableTimerExW CreateEventW CancelIo GetOverlappedResult ReadFile CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW GetStdHandle PostQueuedCompletionStatus FindNextFileW DeleteCriticalSection

user32

CreateWindowExW DestroyWindow SetWindowPos GetMessageA DispatchMessageA TranslateMessage EnumChildWindows IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos RegisterWindowMessageA AdjustWindowRect SetCapture RedrawWindow SetWindowLongPtrW GetMessageW ReleaseCapture GetRawInputData ValidateRect PostThreadMessageW PeekMessageW GetUpdateRect MapVirtualKeyW DispatchMessageW MsgWaitForMultipleObjectsEx TranslateAcceleratorW IsClipboardFormatAvailable GetClipboardData DefWindowProcW EmptyClipboard InvalidateRgn SetClipboardData GetWindowLongW GetMenu AdjustWindowRectEx RegisterRawInputDevices ChangeDisplaySettingsExW SetWindowPlacement GetMonitorInfoW RegisterClassExW GetWindowPlacement SetFocus GetWindow GetParent SetWindowRgn FindWindowExW CloseTouchInputHandle GetSystemMenu GetTouchInputInfo SetWindowLongW GetClipCursor GetSystemMetrics ScreenToClient ClipCursor ShowCursor GetKeyboardLayout MapVirtualKeyExW TrackMouseEvent SystemParametersInfoW GetAsyncKeyState EnableMenuItem FlashWindowEx LoadCursorW DrawIconEx SetCursor IsIconic GetDC RegisterTouchWindow AppendMenuW InsertMenuW IsWindow SetCursorPos SendInput CheckMenuItem DrawTextW UpdateWindow InvalidateRect ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW PostQuitMessage ShowWindow SendMessageW SystemParametersInfoA PostMessageW GetActiveWindow GetForegroundWindow IsWindowEnabled SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu SetWindowTextW IsWindowVisible GetWindowTextW GetWindowTextLengthW EnableWindow SetParent SetPropW GetKeyboardState EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity CloseClipboard MonitorFromRect ToUnicodeEx GetKeyState OpenClipboard GetWindowLongPtrW

shell32

ShellExecuteExW SHOpenFolderAndSelectItems SHAppBarMessage SHGetKnownFolderPath ILCreateFromPathW DragQueryFileW DragFinish ShellExecuteW ILFree

ole32

CoUninitialize CoTaskMemAlloc CoCreateInstance CoTaskMemFree RevokeDragDrop RegisterDragDrop OleInitialize CoInitializeEx CoInitialize CoCreateFreeThreadedMarshaler

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

gdi32

CreateRectRgn DeleteDC SetTextColor SetBkMode CreateDIBSection SelectObject CombineRgn BitBlt CreateCompatibleDC DeleteObject CreateSolidBrush GetDeviceCaps

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

advapi32

RegOpenKeyExW RegQueryValueExW RegDeleteTreeW RegCloseKey RegSetValueExW RegGetValueW EventSetInformation ImpersonateAnonymousToken RevertToSelf RegCreateKeyExW EventRegister EventUnregister EventWriteTransfer

shlwapi

SHCreateMemStream

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

oleaut32

SysStringLen SetErrorInfo SysFreeString GetErrorInfo

ws2_32

freeaddrinfo send WSAStartup getaddrinfo bind WSACleanup recv getsockopt connect setsockopt ioctlsocket WSASocketW WSASend shutdown closesocket WSAIoctl getsockname WSAGetLastError getpeername

crypt32

CertDuplicateCertificateContext CertGetCertificateChain CertDuplicateStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertFreeCertificateContext CertEnumCertificatesInStore CertFreeCertificateChain CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy

secur32

InitializeSecurityContextW ApplyControlToken EncryptMessage AcquireCredentialsHandleA QueryContextAttributesW DecryptMessage FreeCredentialsHandle AcceptSecurityContext FreeContextBuffer DeleteSecurityContext

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_narrow_argv abort _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment strerror terminate _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-string-l1-1-0

wcscmp strlen _wcsicmp wcslen wcsncat strcpy_s

api-ms-win-crt-math-l1-1-0

floor roundf pow trunc round __setusermatherr

api-ms-win-crt-heap-l1-1-0

calloc free malloc _callnewh _set_new_mode

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_3083f26ca71f890b4d047a1219ae480c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

ntdll

kernel32

user32

shell32

ole32

api-ms-win-core-synch-l1-2-0

gdi32

comctl32

advapi32

shlwapi

dwmapi

oleaut32

ws2_32

crypt32

secur32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic