2026-10-26_59d9fe9a412817450090b6da336a9027_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_59d9fe9a412817450090b6da336a9027_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 18.9MB
Sample261027-t8cb3sew4x
SHA256 8df9840054926cdeaff8338cc1be0993815f1229694b47508d42189f7e6235dd
MD5 59d9fe9a412817450090b6da336a9027
SHA1 543610def3a4a35c9840e64489eb9d054705ea30
SHA512 fc3982a8ee4189145334944c090af08fa1e408e696698771e585864a6bd268baf363e84d22e635ccfa54954783366780cd493151b76f39eb41cbfa9839c45018
SSDEEP 98304:/SrqbtEmkNlWDWM6Y+0vLt5IVXgc8R3LP3chuLw5GYKWYM1fjaHwhaKPSG+h4Axm:/SrqJPgVXg3R3Lk0LQh8w7G4OX0QQQm
TLSH
T171173812BA9B58ACD09AC8B483464A335A3134CB0B35BAFF45D491353FADBF45E38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_59d9fe9a412817450090b6da336a9027_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

File Explorer

2026-10-26_59d9fe9a412817450090b6da336a9027_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

.exe 18.9MB

2026-10-26_59d9fe9a412817450090b6da336a9027_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

IMPHASH 77f044f48f14d4aebe54c2b983e040f8
SHA256 8df9840054926cdeaff8338cc1be0993815f1229694b47508d42189f7e6235dd
MD5 59d9fe9a412817450090b6da336a9027
SHA1 543610def3a4a35c9840e64489eb9d054705ea30
SHA512 fc3982a8ee4189145334944c090af08fa1e408e696698771e585864a6bd268baf363e84d22e635ccfa54954783366780cd493151b76f39eb41cbfa9839c45018
SSDEEP 98304:/SrqbtEmkNlWDWM6Y+0vLt5IVXgc8R3LP3chuLw5GYKWYM1fjaHwhaKPSG+h4Axm:/SrqJPgVXg3R3Lk0LQh8w7G4OX0QQQm
TLSH
T171173812BA9B58ACD09AC8B483464A335A3134CB0B35BAFF45D491353FADBF45E38719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14511680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

eToE.pdb

kernel32

GetTimeZoneInformationForYear SystemTimeToFileTime GetModuleFileNameW SetThreadErrorMode LoadLibraryExW FreeLibrary GetProcAddress GetLastError InitializeSListHead CloseHandle UnmapViewOfFile OpenFileMappingW MapViewOfFile CreateToolhelp32Snapshot Thread32First OpenThread Thread32Next GetThreadTimes OpenProcess GetProcessTimes TerminateProcess LoadLibraryW RtlVirtualUnwind WaitForMultipleObjects WaitForSingleObject OpenEventW CreateEventW ResetEvent CreateFileMappingW ReadProcessMemory IsProcessCritical Process32FirstW Process32NextW QueryFullProcessImageNameW GetLocalTime FlushFileBuffers GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer SetUnhandledExceptionFilter OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId lstrlenW GetCurrentProcess CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime DuplicateHandle SetHandleInformation AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetFileAttributesW CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW GetFileInformationByHandleEx SwitchToThread GetOverlappedResult GetFileInformationByHandle FindFirstFileExW FindClose GetConsoleMode GetModuleHandleW SetEnvironmentVariableW GetModuleHandleA ExitProcess QueryPerformanceFrequency CancelIo WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread ReadFileEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime GetExitCodeProcess GetProcessId RtlLookupFunctionEntry FindNextFileW LockFile RtlCaptureContext

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

ntdll

NtReadFile NtQueryInformationProcess NtQuerySystemInformation RtlNtStatusToDosError NtOpenFile NtWriteFile NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle SystemFunction036 RegQueryValueExW

user32

IsWindowVisible GetWindowThreadProcessId EnumWindows ShowWindow GetWindowTextW GetClassNameW GetWindowRect SystemParametersInfoW

psapi

GetProcessMemoryInfo

ws2_32

freeaddrinfo WSAGetLastError WSASocketW WSADuplicateSocketW getsockopt setsockopt closesocket ioctlsocket recv send getpeername getsockname bind listen WSARecv WSASend connect select WSAStartup WSACleanup getaddrinfo

iphlpapi

GetExtendedTcpTable

vcruntime140

__current_exception_context __current_exception __CxxFrameHandler3 memcpy memcmp memset memmove strchr strrchr _CxxThrowException memchr __C_specific_handler

api-ms-win-crt-math-l1-1-0

rint sinf expf floorf ceilf pow _hypotf truncf round roundf atan2f cosf fmaf fma log2f powf logf exp log2 ceil floor __setusermatherr log

api-ms-win-crt-string-l1-1-0

strspn strlen strcmp strcspn strncmp

api-ms-win-crt-heap-l1-1-0

malloc _msize _set_new_mode free realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_set_app_type _endthreadex _beginthreadex _crt_atexit _register_onexit_function _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_59d9fe9a412817450090b6da336a9027_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

bcrypt

advapi32

user32

psapi

ws2_32

iphlpapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic