2026-06-03_e7dabac4dd7ecdcdf676bef8edb2d377_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-03_e7dabac4dd7ecdcdf676bef8edb2d377_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 2.9MB
Sample260603-nb5pgaez7k
SHA256 813ac51056c2dc08af924c8655508b26e7ce1facbb4181f1062088ba11bf8817
MD5 e7dabac4dd7ecdcdf676bef8edb2d377
SHA1 8020ce1cc63c865442418fd80c089018c60b716f
SHA512 5ed829e8a01ca5d199c2f770713b4c94bef9439c9da6582dfedf545f8753d639060d3326e600826e562de462fe67d9ccb0a2a241d204088f070da6b777d741f1
SSDEEP 49152:fzkjN/E6rYES1vq+9dHWmtG0fZeza4Mr7QhoXc/ndR:sZ0fJs/dR
TLSH
T13BD529217E4999EDC45BC074C2468AA2693270CF0F35BAFF44949A783E79AF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-03_e7dabac4dd7ecdcdf676bef8edb2d377_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-06-03_e7dabac4dd7ecdcdf676bef8edb2d377_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 2.9MB

2026-06-03_e7dabac4dd7ecdcdf676bef8edb2d377_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH e1a2c14f871d702d45a70c3968b8c925
SHA256 813ac51056c2dc08af924c8655508b26e7ce1facbb4181f1062088ba11bf8817
MD5 e7dabac4dd7ecdcdf676bef8edb2d377
SHA1 8020ce1cc63c865442418fd80c089018c60b716f
SHA512 5ed829e8a01ca5d199c2f770713b4c94bef9439c9da6582dfedf545f8753d639060d3326e600826e562de462fe67d9ccb0a2a241d204088f070da6b777d741f1
SSDEEP 49152:fzkjN/E6rYES1vq+9dHWmtG0fZeza4Mr7QhoXc/ndR:sZ0fJs/dR
TLSH
T13BD529217E4999EDC45BC074C2468AA2693270CF0F35BAFF44949A783E79AF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1796640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

malware_analysis.pdb

kernel32

ReadFile SetFileCompletionNotificationModes GetOverlappedResult CreateIoCompletionPort GetQueuedCompletionStatusEx Sleep GetModuleHandleA PostQueuedCompletionStatus DuplicateHandle GetCurrentProcess GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime SetHandleInformation CompareStringOrdinal GetLastError InitializeSListHead WaitForSingleObject FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetConsoleWindow GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CloseHandle CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW FindFirstFileExW FindClose GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW FormatMessageW GetModuleFileNameW WaitForMultipleObjects SetUnhandledExceptionFilter

ws2_32

closesocket WSASocketW WSAIoctl connect ioctlsocket shutdown getsockopt getpeername getsockname send WSASend recv getaddrinfo setsockopt WSAGetLastError freeaddrinfo WSAStartup bind WSACleanup

secur32

FreeCredentialsHandle DeleteSecurityContext FreeContextBuffer AcquireCredentialsHandleA ApplyControlToken DecryptMessage InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW EncryptMessage

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

crypt32

CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateChain CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateCertificateChain CertDuplicateStore CertCloseStore CertOpenStore

advapi32

RegQueryValueExW RegCloseKey SystemFunction036 RegOpenKeyExW

ntdll

NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile NtDeviceIoControlFile

bcryptprimitives

ProcessPrng

user32

ShowWindow

bcrypt

BCryptGenRandom

vcruntime140

memcpy __CxxFrameHandler3 memcmp __C_specific_handler __current_exception __current_exception_context _CxxThrowException memset memmove

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm_e _initterm _get_initial_narrow_environment __p___argc _initialize_narrow_environment _configure_narrow_argv __p___argv _cexit terminate _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _crt_atexit _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-03_e7dabac4dd7ecdcdf676bef8edb2d377_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

ws2_32

secur32

api-ms-win-core-synch-l1-2-0

crypt32

advapi32

ntdll

bcryptprimitives

user32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic