2026-10-25_b765a4b85a83135e650f5dfb10662dd5_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_b765a4b85a83135e650f5dfb10662dd5_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom
Size 10.5MB
Sample261026-sa7vnabc95
SHA256 b83281481df95b14a40940821c4959080478a0f897ad6c0ef4df137b408ae7b5
MD5 b765a4b85a83135e650f5dfb10662dd5
SHA1 5d6f2d18fd3b4c8cea7b96abce2fcb00414fb324
SHA512 fe03e33b97bc43937007f5907827d537efda0677d7f2a7910dc0c4d6b5c7ad345ebd681568f2c1e7ce1785413362d8a889aa1fde9d72db659a1a4ac5027fbf1a
SSDEEP 98304:65Esxdi7+xE4QkNhSjChQLwxqfkxE4ZNbl7O4T:KjQghQL4/
TLSH
T18BB67C42B6ABA4EDD16AC870830A96736E2174CB072679FF41C495383F69FE05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_b765a4b85a83135e650f5dfb10662dd5_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

File Explorer

2026-10-25_b765a4b85a83135e650f5dfb10662dd5_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

.exe 10.5MB

2026-10-25_b765a4b85a83135e650f5dfb10662dd5_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

IMPHASH 619757f99eedb1fb1aef1229ae17a590
SHA256 b83281481df95b14a40940821c4959080478a0f897ad6c0ef4df137b408ae7b5
MD5 b765a4b85a83135e650f5dfb10662dd5
SHA1 5d6f2d18fd3b4c8cea7b96abce2fcb00414fb324
SHA512 fe03e33b97bc43937007f5907827d537efda0677d7f2a7910dc0c4d6b5c7ad345ebd681568f2c1e7ce1785413362d8a889aa1fde9d72db659a1a4ac5027fbf1a
SSDEEP 98304:65Esxdi7+xE4QkNhSjChQLwxqfkxE4ZNbl7O4T:KjQghQL4/
TLSH
T18BB67C42B6ABA4EDD16AC870830A96736E2174CB072679FF41C495383F69FE05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6952784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

to_engine-d496920335910f17.pdb

kernel32

GetProcAddress Sleep GetModuleFileNameW SwitchToThread DuplicateHandle GetModuleHandleA SleepEx SetLastError GetCurrentThreadId QueryPerformanceFrequency QueryPerformanceCounter CloseHandle WaitForSingleObject GetConsoleScreenBufferInfo SetConsoleTextAttribute FindNextFileW CancelIo GetFileType GetFileAttributesW GetConsoleOutputCP GetConsoleMode WriteConsoleW FindClose FindFirstFileExW SetFilePointerEx CreateDirectoryW GetStdHandle GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime CreateFileW GetOverlappedResult ReadFile GetFullPathNameW WriteFileEx ReadFileEx HeapAlloc HeapFree GetProcessHeap SetEvent LoadLibraryExA InitializeSListHead SetUnhandledExceptionFilter LocalFree RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FormatMessageW GetModuleHandleW SetWaitableTimer CreateWaitableTimerExW ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx ExitProcess GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetExitCodeProcess WaitForMultipleObjects CreateProcessW CreateEventW GetCurrentProcess CreateThread GetLastError GetEnvironmentStringsW SystemTimeToTzSpecificLocalTime MultiByteToWideChar WideCharToMultiByte lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetWindowsDirectoryW GetSystemDirectoryW FreeEnvironmentStringsW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime CompareStringOrdinal MapViewOfFile CreateFileMappingW VirtualProtect UnmapViewOfFile GetSystemInfo HeapReAlloc

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

RtlNtStatusToDosError NtOpenFile NtWriteFile NtReadFile NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

oleaut32

SysFreeString SysStringLen

user32

DestroyIcon CreateIcon

bcryptprimitives

ProcessPrng

crypt32

CryptProtectData CryptUnprotectData

vcruntime140

__current_exception __C_specific_handler __current_exception_context memset memcpy __CxxFrameHandler3 memmove memcmp _CxxThrowException

api-ms-win-crt-math-l1-1-0

round asinf atan trunc tanf powf fmod fmodf floorf log sinf cosf __setusermatherr pow _hypot tan cbrtf log2 sin cos atan2 cbrt atan2f fma ceil floor truncf exp2f roundf expf ceilf _hypotf

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_onexit_function __p___argc __p___argv _cexit _initialize_onexit_table _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_b765a4b85a83135e650f5dfb10662dd5_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

oleaut32

user32

bcryptprimitives

crypt32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic