Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 03:03
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-22_2808a18de24c4a91d3a796903486abd0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_2808a18de24c4a91d3a796903486abd0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win11-20260513-en
2 signatures
150 seconds
General
- Target 2026-05-22_2808a18de24c4a91d3a796903486abd0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
- Size 5.6MB
- Sample260522-dkdx1ac15k
- SHA256 0c78576b4d7d3d7d2e7b80720185a6b00fb7049a933cfdeb85f585834de38d3b
- MD5 2808a18de24c4a91d3a796903486abd0
- SHA1 ddd3980fb81c8f15c93faffd9e38a423a6c29021
- SHA512 13f73a23808206ac01330d8fa2e80f1ecc434edf61e2bd4da72fd623b66593155ccf230ce056cf4e27dba2d63b1487b20d36be14b51738632bbda5d8c47915f9
- SSDEEP 49152:p0k19ZWtMUVqvkO8vP5/U/HGchJsVE2976nCJ6jrzooMn1HCQloCcbycfDQknXlz:trY35YRhBoVn1iEQ5Qkquon+G+O
- TLSH T149466C07E69580E9C06EC078C31B9637FB72B88D1635B29B6BF48A112F26F505F2D719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 5 discord.com - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 756 2026-05-22_2808a18de24c4a91d3a796903486abd0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe 756 2026-05-22_2808a18de24c4a91d3a796903486abd0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_2808a18de24c4a91d3a796903486abd0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_2808a18de24c4a91d3a796903486abd0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:756