2026-11-01_c38a4a35222cccb941744541263f656d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_c38a4a35222cccb941744541263f656d_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 13.5MB
Sample261102-ld45lsstbz
SHA256 8aef8f273341ebccbbd0b059f6aa85cfa3c59e9248cb7630e786c2b4cfa1565c
MD5 c38a4a35222cccb941744541263f656d
SHA1 d4c877fa8345a12fcb2506ae4ae86ffefc6d79ee
SHA512 094381bd0cf2fb73e620aed1e85dfa7ba0716f5723cc1ae2473b48eeb94b712d0ca0f090c10215c07de1a0d2e437eb715c6f14f7901089373688c3d369810126
SSDEEP 98304:n1wP14U+x6HV4qrF4M7snF/wi4ET4VDYGr++dsiJuzoZf2:uFrMU2a2
TLSH
T129E6F5116B9E99ADD19AC874834B4B724A3130CB0B35B9FF44D482792FBDAF45A3C319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_c38a4a35222cccb941744541263f656d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-11-01_c38a4a35222cccb941744541263f656d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 13.5MB

2026-11-01_c38a4a35222cccb941744541263f656d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 7648ae5dde572883a6eb76566a6c4e2f
SHA256 8aef8f273341ebccbbd0b059f6aa85cfa3c59e9248cb7630e786c2b4cfa1565c
MD5 c38a4a35222cccb941744541263f656d
SHA1 d4c877fa8345a12fcb2506ae4ae86ffefc6d79ee
SHA512 094381bd0cf2fb73e620aed1e85dfa7ba0716f5723cc1ae2473b48eeb94b712d0ca0f090c10215c07de1a0d2e437eb715c6f14f7901089373688c3d369810126
SSDEEP 98304:n1wP14U+x6HV4qrF4M7snF/wi4ET4VDYGr++dsiJuzoZf2:uFrMU2a2
TLSH
T129E6F5116B9E99ADD19AC874834B4B724A3130CB0B35B9FF44D482792FBDAF45A3C319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10601088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vrising_status_rs.pdb

ws2_32

send setsockopt ioctlsocket connect sendto WSAIoctl WSASocketW bind shutdown getpeername getsockopt getsockname recv recvfrom WSASend WSAGetLastError closesocket WSACleanup WSAStartup freeaddrinfo getaddrinfo

kernel32

GetModuleHandleW GetProcAddress SetConsoleTextAttribute GetConsoleScreenBufferInfo ReadFile SetConsoleMode GetConsoleMode CreateFileW SetHandleInformation PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx GetOverlappedResult GetLastError SetFileCompletionNotificationModes GetSystemTimeAsFileTime CloseHandle CancelIoEx WriteFile SetNamedPipeHandleState InitializeSListHead GetModuleHandleA FormatMessageW GetFileType GetConsoleOutputCP WriteConsoleW MultiByteToWideChar GetModuleFileNameW HeapAlloc SetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetStdHandle GetFileInformationByHandleEx GetFileInformationByHandle GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext GetCurrentProcess SetUnhandledExceptionFilter GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc HeapFree GetProcessHeap SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SetLastError WaitForSingleObject RtlVirtualUnwind

secur32

FreeCredentialsHandle AcquireCredentialsHandleA EncryptMessage AcceptSecurityContext DeleteSecurityContext QueryContextAttributesW InitializeSecurityContextW FreeContextBuffer DecryptMessage ApplyControlToken

crypt32

CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertCloseStore CertGetCertificateChain CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ntdll

NtReadFile NtDeviceIoControlFile NtWriteFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile

bcryptprimitives

ProcessPrng

vcruntime140

__current_exception _CxxThrowException __current_exception_context memcpy __C_specific_handler memset memmove memcmp __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit _register_thread_local_exe_atexit_callback __p___argc _initialize_onexit_table _exit exit _initterm_e _initterm _register_onexit_function _initialize_narrow_environment _configure_narrow_argv _crt_atexit terminate __p___argv _get_initial_narrow_environment _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_c38a4a35222cccb941744541263f656d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

ws2_32

kernel32

secur32

crypt32

bcrypt

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic