d97b711f543a39e84f194451776d68ed9698b76701aaeba30cdc65290677edb4

General

Target
2026-04-18_8b6bd6e6d9ff086c5c889f25b2d51949_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 2.8MB
Sample260418-e5j57agw6y
SHA256 d97b711f543a39e84f194451776d68ed9698b76701aaeba30cdc65290677edb4
MD5 8b6bd6e6d9ff086c5c889f25b2d51949
SHA1 87fb79dba8f8750d4127bc588a3eab3099c50b4b
SHA512 c4d1687e33cdca8365d5d23704f4ddf6766f3d0b531ba25823bd50515288aafc77dd7941d8bb18dbc5c3107603d0d43409f4d2696a64ab6665e62001555cea00
SSDEEP 49152:BcnQI3tH3JhcXUQ64qprVOGYcr9ZLui8JMjlui/9qFLS:gLtHOvyn3y/JMjL/kF2
TLSH
T13ED56D53FA5685E8C09DC178C7169232BB32BC8D4A2177AB27D43E213E76BA05F5D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-04-18_8b6bd6e6d9ff086c5c889f25b2d51949_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 2.8MB
- SHA256 d97b711f543a39e84f194451776d68ed9698b76701aaeba30cdc65290677edb4
- MD5 8b6bd6e6d9ff086c5c889f25b2d51949
- SHA1 87fb79dba8f8750d4127bc588a3eab3099c50b4b
- SHA512 c4d1687e33cdca8365d5d23704f4ddf6766f3d0b531ba25823bd50515288aafc77dd7941d8bb18dbc5c3107603d0d43409f4d2696a64ab6665e62001555cea00
- SSDEEP 49152:BcnQI3tH3JhcXUQ64qprVOGYcr9ZLui8JMjlui/9qFLS:gLtHOvyn3y/JMjL/kF2
- TLSH
  T13ED56D53FA5685E8C09DC178C7169232BB32BC8D4A2177AB27D43E213E76BA05F5D348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware stealer
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Looks for VMWare drivers on disk
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2