2026-11-02_e365fc9554085c083d64001d6b704f3d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_e365fc9554085c083d64001d6b704f3d_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 16.3MB
Sample261102-yzf15afs2m
SHA256 83cedb2662e24091a50891329f22389dc126a1744ffb9f9679da3416b2475d80
MD5 e365fc9554085c083d64001d6b704f3d
SHA1 d19424aa7bd79b2fc511739cb97f4a1f1fe320ac
SHA512 f802012167e4b71fc59f1649a99e9abef51f4422a6efbf2548f5acf3af21ee1be361a19d1a12261eb072f03338ec9d5e7b41d5ab949fa7db0102d588de3f207d
SSDEEP 393216:F7TD/D3GgqS4/0kGeD6uw4dLyy8ZNHGa5:FTD/D3GgqS4/0kGeDZw4oyQ
TLSH
T15B07F7257B5B99A8D09BC47083478A724A3134CB0B35B9FF44C496382F7ABF56F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-02_e365fc9554085c083d64001d6b704f3d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 16.3MB

2026-11-02_e365fc9554085c083d64001d6b704f3d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH c8a92a66b63c6dbd85ee7084a0fc40cb
SHA256 83cedb2662e24091a50891329f22389dc126a1744ffb9f9679da3416b2475d80
MD5 e365fc9554085c083d64001d6b704f3d
SHA1 d19424aa7bd79b2fc511739cb97f4a1f1fe320ac
SHA512 f802012167e4b71fc59f1649a99e9abef51f4422a6efbf2548f5acf3af21ee1be361a19d1a12261eb072f03338ec9d5e7b41d5ab949fa7db0102d588de3f207d
SSDEEP 393216:F7TD/D3GgqS4/0kGeD6uw4dLyy8ZNHGa5:FTD/D3GgqS4/0kGeDZw4oyQ
TLSH
T15B07F7257B5B99A8D09BC47083478A724A3134CB0B35B9FF44C496382F7ABF56F38259
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

f9:fa:be:23:ce:05:6a:65:7d:44:08:03:28:d8:ac:e9:3f:c0:f6:32:6d:be:39:75:a3:50:0d:8e:b4:83:60:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Folkward LLC,O=Folkward LLC,L=Austin,ST=Texas,C=US

Chains

Oct 30, 2026

CN=Folkward LLC,O=Folkward LLC,L=Austin,ST=Texas,C=US

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Folkward LLC,O=Folkward LLC,L=Austin,ST=Texas,C=US

Serial Number

33:00:09:bc:60:ad:98:77:19:5f:f7:92:1e:00:00:00:09:bc:60

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 29, 2026 - Nov 1, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

11724592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

flackle_desktop.pdb

bcryptprimitives

ProcessPrng

user32

DrawMenuBar SetMenu CheckMenuItem CreateAcceleratorTableW GetMenuItemInfoW DrawIconEx DestroyAcceleratorTable SetTimer DestroyWindow KillTimer TrackPopupMenu ChangeWindowMessageFilterEx SetMenuItemInfoW CreateIcon GetKeyboardState MapVirtualKeyExW TranslateAcceleratorW ToUnicodeEx GetKeyboardLayout SystemParametersInfoA SetPropW GetMenu ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem InsertMenuW GetSystemMenu GetRawInputData SendInput SetForegroundWindow EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx AppendMenuW RegisterRawInputDevices RegisterWindowMessageA GetWindow SetParent FindWindowW CreateWindowExW MapWindowPoints PostQuitMessage DestroyMenu SetFocus GetWindowRect GetParent CreateMenu SetWindowRgn EnableWindow IsWindowEnabled ReleaseDC GetDC IsProcessDPIAware GetMenuBarInfo OffsetRect GetIconInfo LoadImageW DestroyIcon RegisterHotKey RegisterClassW UnregisterHotKey UnhookWinEvent GetAsyncKeyState GetMonitorInfoW MonitorFromWindow MonitorFromRect SendMessageW GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo DefWindowProcW TrackMouseEvent FillRect ScreenToClient AdjustWindowRect GetWindowDC GetUpdateRect ValidateRect SetWinEventHook ChangeDisplaySettingsExW MapVirtualKeyW DrawTextW RegisterTouchWindow GetActiveWindow UpdateWindow InvalidateRect InvalidateRgn ClientToScreen SetWindowPos VkKeyScanW GetKeyState RedrawWindow RegisterClassExW GetLastInputInfo GetMessageA TranslateMessage DispatchMessageA EnumChildWindows IsIconic PostMessageW AdjustWindowRectEx CreatePopupMenu SetCursorPos GetForegroundWindow FindWindowExW GetMessageW RemoveMenu DispatchMessageW FlashWindowEx PostThreadMessageW SetWindowLongPtrW PeekMessageW SetWindowPlacement GetWindowPlacement LoadCursorW SetCursor GetWindowThreadProcessId IsWindowVisible ShowWindow GetWindowLongPtrW IsWindow GetCursorPos SystemParametersInfoW GetClientRect GetWindowLongW EnumWindows GetClassNameW

kernel32

FormatMessageW HeapAlloc SetEnvironmentVariableW DeleteFileW HeapFree Sleep GetModuleHandleA DeviceIoControl lstrlenW LoadLibraryA ReleaseMutex LoadLibraryW CreateSymbolicLinkW GetFinalPathNameByHandleW GetModuleHandleW CreateMutexA GetProcessHeap WaitForSingleObjectEx WideCharToMultiByte GetUserDefaultUILanguage FreeLibrary LCIDToLocaleName SwitchToThread GetSystemInfo GetProcAddress ExitProcess MultiByteToWideChar FindClose FindFirstFileExW LoadLibraryExA GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW GetStdHandle GetEnvironmentStringsW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW SetWaitableTimer GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess GetSystemTimeAsFileTime ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetFullPathNameW SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW RtlVirtualUnwind CreateMutexW EncodePointer ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader RaiseException FlsAlloc GetTempPathW FindNextFileW SetHandleInformation FlsGetValue OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW GetConsoleMode FlsSetValue GetFileInformationByHandle GetFileAttributesW GetQueuedCompletionStatusEx CancelIoEx WriteFile GetOverlappedResult ReadFile PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort FlsFree InitializeSListHead SetUnhandledExceptionFilter DeleteCriticalSection RtlUnwindEx GetLastError GetFileInformationByHandleEx GetTickCount CloseHandle InitializeCriticalSectionEx SetNamedPipeHandleState GetCurrentThreadId CreateFileW

shell32

ILCreateFromPathW SHOpenFolderAndSelectItems ShellExecuteExW ShellExecuteW SHCreateItemFromParsingName SHGetKnownFolderPath DragQueryFileW DragFinish SHAppBarMessage ILFree SHGetStockIconInfo Shell_NotifyIconGetRect Shell_NotifyIconW

ole32

RevokeDragDrop CoInitializeEx CoCreateInstance CoTaskMemFree CoUninitialize RegisterDragDrop OleInitialize CoInitialize CoIncrementMTAUsage CoCreateFreeThreadedMarshaler

shlwapi

SHCreateMemStream

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

GetErrorInfo SetErrorInfo SysStringLen SysFreeString

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

advapi32

RegSetValueExW RegCloseKey RegDeleteValueW RegQueryValueExW RegGetValueW RegOpenKeyExW EventRegister EventWriteTransfer SystemFunction036 EventUnregister EventSetInformation

ntdll

NtOpenFile NtCreateNamedPipeFile NtDeviceIoControlFile NtCreateFile RtlGetVersion NtWriteFile NtReadFile RtlNtStatusToDosError NtCancelIoFileEx

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

gdi32

CreateSolidBrush DeleteDC CreateRectRgn SetTextColor SetBkMode DeleteObject GetDeviceCaps GetDIBits CreateCompatibleDC CombineRgn SelectObject CreateDIBSection BitBlt

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

comctl32

TaskDialogIndirect DefSubclassProc SetWindowSubclass RemoveWindowSubclass

imm32

ImmReleaseContext ImmGetCompositionStringW ImmGetContext

combase

CoTaskMemAlloc

ws2_32

WSASend ioctlsocket connect recv send bind shutdown setsockopt WSAIoctl WSAGetLastError getaddrinfo getsockname WSASocketW getpeername freeaddrinfo WSACleanup WSAStartup getsockopt closesocket

crypt32

CertGetCertificateChain CertOpenStore CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertFreeCertificateChainEngine CertCloseStore CertFreeCertificateContext CertSetCertificateContextProperty CertCreateCertificateChainEngine

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

floor roundf fmod round pow __setusermatherr trunc

api-ms-win-crt-string-l1-1-0

strlen strcpy_s _wcsicmp wcslen wcscmp

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _c_exit _exit exit _initterm_e _initterm _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _configure_narrow_argv _crt_atexit terminate _cexit _set_app_type _seh_filter_exe abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode calloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_e365fc9554085c083d64001d6b704f3d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

user32

kernel32

shell32

ole32

shlwapi

api-ms-win-core-winrt-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-0

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

gdi32

dwmapi

comctl32

imm32

combase

ws2_32

crypt32

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic