2026-10-25_90b6068413d193001be4c0deddf15aee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_90b6068413d193001be4c0deddf15aee_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 6.0MB
Sample261026-ytm79aws5k
SHA256 2c48aefcf340047106f9fe325e60e67ce3789138b16a21382fb55f4d03635c93
MD5 90b6068413d193001be4c0deddf15aee
SHA1 74e8ada3c44c0d473fc3b7aba459db5d1ada57fe
SHA512 ff2821e318c1b2bd5b06e5a75a6fbb9453252e9799b24ec045cde028eba9a858ac68845fb141516160405819d17141cdc70dcf19ebc2eaa6459d3e3d461a9d1c
SSDEEP 49152:xyNdeE0OM3alAfye/qt1qPYkY4hHaDaeMz5AzWugONRKDEGrtYo1Y9G8Tmylu+ZC:hfBdRRZtpE+QJM
TLSH
T1FE56D816A67960D9D17FC078D2879F22BD21749907393BF789D0826A2F24EF8AD3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_90b6068413d193001be4c0deddf15aee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-25_90b6068413d193001be4c0deddf15aee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 6.0MB

2026-10-25_90b6068413d193001be4c0deddf15aee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH b4aaba0c31b209503eb28f90a1bc4a9d
SHA256 2c48aefcf340047106f9fe325e60e67ce3789138b16a21382fb55f4d03635c93
MD5 90b6068413d193001be4c0deddf15aee
SHA1 74e8ada3c44c0d473fc3b7aba459db5d1ada57fe
SHA512 ff2821e318c1b2bd5b06e5a75a6fbb9453252e9799b24ec045cde028eba9a858ac68845fb141516160405819d17141cdc70dcf19ebc2eaa6459d3e3d461a9d1c
SSDEEP 49152:xyNdeE0OM3alAfye/qt1qPYkY4hHaDaeMz5AzWugONRKDEGrtYo1Y9G8Tmylu+ZC:hfBdRRZtpE+QJM
TLSH
T1FE56D816A67960D9D17FC078D2879F22BD21749907393BF789D0826A2F24EF8AD3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4558144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

asterfall_smoke_setup.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

GetSystemTimeAsFileTime SetUnhandledExceptionFilter FindNextFileW InitializeSListHead CloseHandle RtlVirtualUnwind GetLastError WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetModuleHandleW FormatMessageW GetModuleFileNameW GetModuleHandleA

ntdll

NtWriteFile NtOpenFile RtlNtStatusToDosError NtReadFile

ws2_32

closesocket getaddrinfo WSAGetLastError setsockopt getsockopt ioctlsocket recv getpeername connect select send WSASocketW freeaddrinfo WSAStartup WSACleanup

vcruntime140

memset __CxxFrameHandler3 __current_exception __C_specific_handler _CxxThrowException __current_exception_context memcpy memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type terminate _crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _register_onexit_function _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _cexit _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_90b6068413d193001be4c0deddf15aee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic