2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 16.3MB
Sample260629-hcdpgsfs3z
SHA256 c57586eb0724cc401da7da8e39b668fabfe405f04d29faf1f4c59cb9dc8f7b5a
MD5 675153d1322e3b39384cafb38135d79f
SHA1 a15ff90d15e48bd83c89c80221ceee10b4a93abc
SHA512 2190395e1f50f00772c47692ca043c3cd80ea77c8b226bc3dde813bb5c79dcd755cdacb66b947e847a8bafa6f4216c235abf5ce4c175ca2b9686ce022016d88c
SSDEEP 196608:A/T/jvVZ9etsZTokGOaaya8l0S7oPTLhzb8iO2M0t7:m/jxrZTJGOaayFsPTLhv8hM
TLSH
T1D50707217B5A99ADC05BC474834B8B72497130CB0B39B9FF449496382F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

File Explorer

2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

.exe 16.3MB

2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

IMPHASH dd33a6578884e392d1fb25ea9e1c7c95
SHA256 c57586eb0724cc401da7da8e39b668fabfe405f04d29faf1f4c59cb9dc8f7b5a
MD5 675153d1322e3b39384cafb38135d79f
SHA1 a15ff90d15e48bd83c89c80221ceee10b4a93abc
SHA512 2190395e1f50f00772c47692ca043c3cd80ea77c8b226bc3dde813bb5c79dcd755cdacb66b947e847a8bafa6f4216c235abf5ce4c175ca2b9686ce022016d88c
SSDEEP 196608:A/T/jvVZ9etsZTokGOaaya8l0S7oPTLhzb8iO2M0t7:m/jxrZTJGOaayFsPTLhv8hM
TLSH
T1D50707217B5A99ADC05BC474834B8B72497130CB0B39B9FF449496382F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10323388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ui.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion NtCancelIoFileEx NtDeviceIoControlFile RtlNtStatusToDosError NtCreateFile NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile

advapi32

RegQueryValueExW RegCloseKey RegGetValueW RegOpenKeyExW SystemFunction036 EventSetInformation EventWriteTransfer EventUnregister EventRegister

kernel32

OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW WaitForSingleObject FreeLibrary lstrlenW SetHandleInformation GetUserDefaultUILanguage LCIDToLocaleName LoadLibraryA GetConsoleMode GetFileInformationByHandle CreateSemaphoreW CancelIo WaitForSingleObjectEx ReleaseSemaphore ReadDirectoryChangesW GetFileAttributesW SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx ReadFile PostQueuedCompletionStatus GetOverlappedResult GetModuleHandleW GetCurrentThreadId GetSystemFirmwareTable GetModuleHandleA Sleep LoadLibraryW GetProcAddress ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryExA WakeAllConditionVariable HeapAlloc SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsAlloc FormatMessageW FlsGetValue CreateFileW WriteFile CreateFileA DeviceIoControl FlsSetValue SetNamedPipeHandleState FlsFree CloseHandle GetLastError EncodePointer SetUnhandledExceptionFilter InitializeSListHead DeleteCriticalSection RtlVirtualUnwind GetEnvironmentVariableW HeapReAlloc GetCurrentProcess WideCharToMultiByte GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle SetFileTime DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW RtlUnwindEx CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW GetFileInformationByHandleEx SwitchToThread CreateEventW DeleteFileW FindFirstFileExW FindClose SetEnvironmentVariableW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceFrequency MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread WaitForMultipleObjects ReadFileEx InitializeCriticalSectionEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW

ole32

CoCreateFreeThreadedMarshaler RegisterDragDrop CoCreateInstance CoTaskMemAlloc CoInitializeEx OleInitialize CoInitialize CoUninitialize CoTaskMemFree RevokeDragDrop

user32

ShowCursor ClipCursor RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetSystemMenu EnableMenuItem RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC GetKeyboardLayout MapVirtualKeyExW GetKeyboardState SetPropW SystemParametersInfoA DrawTextW IsProcessDPIAware SetWindowDisplayAffinity GetWindowDC OffsetRect DestroyIcon IsWindowEnabled MonitorFromPoint GetMenuBarInfo GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn DestroyMenu DrawIconEx CheckMenuItem EnumDisplayMonitors SetForegroundWindow CreateWindowExW RemoveMenu CreatePopupMenu CreateMenu SetMenuItemInfoW SendInput RegisterClassExW GetClipCursor GetWindowTextLengthW GetWindowTextW AdjustWindowRect GetForegroundWindow ToUnicodeEx AppendMenuW InsertMenuW RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx SetWindowTextW GetRawInputData SetWindowPos GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetKeyState LoadCursorW InvalidateRgn GetWindowPlacement TrackPopupMenu PostQuitMessage EnumChildWindows DestroyWindow CreateAcceleratorTableW GetDC GetMenu IsWindowVisible SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW DestroyAcceleratorTable FillRect DrawMenuBar GetSystemMetrics SetMenu GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect ScreenToClient GetMenuItemInfoW DefWindowProcW PostThreadMessageW PeekMessageW DispatchMessageW GetMessageW IsIconic RedrawWindow SendMessageW CreateIcon DispatchMessageA TranslateMessage GetMessageA EnableWindow SetLayeredWindowAttributes SetWindowLongW GetWindowLongW TranslateAcceleratorW PostMessageW GetAsyncKeyState

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

gdi32

CreateSolidBrush DeleteDC CreateCompatibleDC CreateRectRgn CreateDIBSection BitBlt GetDeviceCaps CombineRgn SelectObject DeleteObject SetTextColor SetBkMode

shell32

ShellExecuteExW ILFree SHCreateItemFromParsingName SHGetKnownFolderPath ShellExecuteW ILCreateFromPathW DragQueryFileW SHOpenFolderAndSelectItems DragFinish SHAppBarMessage

oleaut32

SetErrorInfo SysStringLen GetErrorInfo SysFreeString

ws2_32

freeaddrinfo getaddrinfo WSACleanup socket WSAGetLastError shutdown listen bind WSASocketW WSAStartup connect ioctlsocket setsockopt send WSASend recv getsockname getpeername accept getsockopt closesocket WSAIoctl

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

roundf pow round floor __setusermatherr trunc

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit __p___argv __p___argc _seh_filter_exe _register_thread_local_exe_atexit_callback _set_app_type _exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate exit abort _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _wassert

api-ms-win-crt-heap-l1-1-0

malloc _callnewh calloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

strcpy_s strlen wcslen _wcsicmp wcscmp

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_675153d1322e3b39384cafb38135d79f_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

bcryptprimitives

ntdll

advapi32

kernel32

ole32

user32

comctl32

shlwapi

api-ms-win-core-synch-l1-2-0

dwmapi

gdi32

shell32

oleaut32

ws2_32

bcrypt

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic