2026-11-01_af8eb9ebaf29be1ccfd77041b28d46c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_af8eb9ebaf29be1ccfd77041b28d46c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 2.3MB
Sample261102-ntdcyasyht
SHA256 91aa9bfc68e15e8f60ea4e11fbfdebf91bd2c1f7ce65d1e34be8fbd30fd00af5
MD5 af8eb9ebaf29be1ccfd77041b28d46c6
SHA1 61e6e14c0a08306772dd22b41b56df323cfa3f8f
SHA512 1053bc8c402d010589d4cf233a2e65d7e31f90b96463bc76c393b45b3835ce5f6d0d78173cb84bbbd5bcede72f5d0afae7fbc29a25873a4c8fb11e93291ad0a8
SSDEEP 49152:c6nA8SHO1eDR42iXs3OUN7Kd3xaXIxYIU6ijyp:c6YP3v21n+jyp
TLSH
T11EB57D03F6A585EAC45AC478C3579632BA73B88D0731B5EF27D04A212E6BBD19F1C316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_af8eb9ebaf29be1ccfd77041b28d46c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-11-01_af8eb9ebaf29be1ccfd77041b28d46c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 2.3MB

2026-11-01_af8eb9ebaf29be1ccfd77041b28d46c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH 1bead535ec132f8826c5e53ab3dc14f0
SHA256 91aa9bfc68e15e8f60ea4e11fbfdebf91bd2c1f7ce65d1e34be8fbd30fd00af5
MD5 af8eb9ebaf29be1ccfd77041b28d46c6
SHA1 61e6e14c0a08306772dd22b41b56df323cfa3f8f
SHA512 1053bc8c402d010589d4cf233a2e65d7e31f90b96463bc76c393b45b3835ce5f6d0d78173cb84bbbd5bcede72f5d0afae7fbc29a25873a4c8fb11e93291ad0a8
SSDEEP 49152:c6nA8SHO1eDR42iXs3OUN7Kd3xaXIxYIU6ijyp:c6YP3v21n+jyp
TLSH
T11EB57D03F6A585EAC45AC478C3579632BA73B88D0731B5EF27D04A212E6BBD19F1C316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1295792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

upd_1_6.pdb

bcryptprimitives

ProcessPrng

kernel32

HeapSize LCMapStringW CompareStringW GetProcAddress LoadLibraryExA GetProcessHeap HeapFree HeapAlloc FormatMessageW FindNextFileW FindClose SetFileTime SetFileAttributesW CopyFileExW GetOverlappedResult LoadLibraryExW VirtualProtect GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetStringTypeW SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage CreateDirectoryW GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW CreateFileW SetFileInformationByHandle UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent DeleteFileW WriteFileEx ReadFileEx CancelIo ReadFile GetFileAttributesW GetCommandLineW SetFilePointerEx GetCommandLineA GetModuleHandleExW PostQueuedCompletionStatus TerminateProcess ExitProcess RtlPcToFileHeader DeleteCriticalSection InitializeCriticalSectionEx DuplicateHandle SetHandleInformation SetLastError LeaveCriticalSection SwitchToThread WaitForMultipleObjects WaitForSingleObject GetExitCodeProcess GetCurrentProcess EnterCriticalSection GetTickCount64 GetSystemInfo CreateMutexW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc RaiseException FlsFree FlsSetValue CloseHandle GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleW GetModuleHandleA GetModuleFileNameW QueryPerformanceFrequency CreateThread SleepEx GetSystemTimePreciseAsFileTime QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer Sleep CreateEventW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetLastError LoadLibraryA FlsGetValue FreeLibrary EncodePointer WriteFile GetFileType FlushFileBuffers GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc

ole32

CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantClear SysFreeString SysStringLen GetErrorInfo SysAllocStringLen

ntdll

NtReadFile NtCreateFile NtDeviceIoControlFile NtOpenFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile NtCreateNamedPipeFile

advapi32

SystemFunction036 OpenProcessToken RegCloseKey RegQueryValueExW RegOpenKeyExW GetTokenInformation

ws2_32

bind setsockopt ioctlsocket WSASocketW closesocket WSASend WSAIoctl WSAStartup WSACleanup getaddrinfo getsockname WSAGetLastError getpeername freeaddrinfo recv getsockopt send shutdown connect

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcrypt

BCryptGenRandom

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

889KB

Virtual Size

889KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_af8eb9ebaf29be1ccfd77041b28d46c6_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

bcryptprimitives

kernel32

ole32

oleaut32

ntdll

advapi32

ws2_32

api-ms-win-core-synch-l1-2-0

bcrypt

generic