2026-11-07_2075ac2e31e7dbe8eeffcd9db9bae02e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_2075ac2e31e7dbe8eeffcd9db9bae02e_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.9MB
Sample261107-tr7fwsc191
SHA256 6811d33020cf569e95c74971547489dfe6458cd03b30ce58e17c11559bc03fec
MD5 2075ac2e31e7dbe8eeffcd9db9bae02e
SHA1 b2172ac00d4e9ce34e5cb682235dc93523756688
SHA512 7f74053c964e47429b057fe70371d0e6e7c809f142f43eaa5baace58fa65a41fd3c35c81183edc77e0d84184bb675f1820bf72082f6f592b9f901bcdae4bd3a9
SSDEEP 49152:AIraXQBSJ8Arm5gnxyB3UxGY2lRcWqS5PnwxmUNIU6i9nIzB:nrnkyO4dPzlD5Yxx6+9I
TLSH
T1DA163913F65150E9C06AC179834A6232FA717C8947347AFF5BD08B212E65FE06B3EB49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_2075ac2e31e7dbe8eeffcd9db9bae02e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-11-07_2075ac2e31e7dbe8eeffcd9db9bae02e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.9MB

2026-11-07_2075ac2e31e7dbe8eeffcd9db9bae02e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 087c29c183656ca00b9c6f9e43a59697
SHA256 6811d33020cf569e95c74971547489dfe6458cd03b30ce58e17c11559bc03fec
MD5 2075ac2e31e7dbe8eeffcd9db9bae02e
SHA1 b2172ac00d4e9ce34e5cb682235dc93523756688
SHA512 7f74053c964e47429b057fe70371d0e6e7c809f142f43eaa5baace58fa65a41fd3c35c81183edc77e0d84184bb675f1820bf72082f6f592b9f901bcdae4bd3a9
SSDEEP 49152:AIraXQBSJ8Arm5gnxyB3UxGY2lRcWqS5PnwxmUNIU6i9nIzB:nrnkyO4dPzlD5Yxx6+9I
TLSH
T1DA163913F65150E9C06AC179834A6232FA717C8947347AFF5BD08B212E65FE06B3EB49
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3156400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

isekai_ssh.pdb

bcryptprimitives

ProcessPrng

ws2_32

listen WSASocketW WSAIoctl WSAGetLastError sendto connect ioctlsocket recvfrom setsockopt accept getsockopt getpeername getsockname send recv closesocket bind freeaddrinfo getaddrinfo WSAStartup select WSACleanup

kernel32

GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileAttributesW MoveFileExW GetCurrentProcess DuplicateHandle UnregisterWaitEx RegisterWaitForSingleObject CloseHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode SetHandleInformation GetConsoleMode SetFileCompletionNotificationModes PostQueuedCompletionStatus GetSystemTimeAsFileTime FindNextFileW GetTempPathW GetModuleHandleA FormatMessageW GetModuleHandleW GetFileType GetFileAttributesW Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar ReadConsoleW GetModuleFileNameW HeapAlloc DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx InitializeSListHead GetProcAddress SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee SetUnhandledExceptionFilter CreateDirectoryW GetStdHandle TerminateProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetFileInformationByHandle WideCharToMultiByte AddVectoredExceptionHandler RtlVirtualUnwind CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtOpenFile NtWriteFile NtReadFile NtDeviceIoControlFile NtCreateNamedPipeFile NtCreateFile RtlNtStatusToDosError NtCancelIoFileEx

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

memcmp memset memmove __CxxFrameHandler3 __current_exception_context memcpy __current_exception __C_specific_handler

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _initterm _initterm_e exit _crt_atexit terminate _exit _get_initial_narrow_environment _register_onexit_function __p___argc __p___argv _cexit _seh_filter_exe _initialize_onexit_table _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_2075ac2e31e7dbe8eeffcd9db9bae02e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

ws2_32

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

advapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic