General
- Target 2026-06-27_3b6f65a4d4bfe794c7eaa935433e79bb_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom
- Size 5.3MB
- Sample260629-j7z2msax5q
- SHA256 7d129423ef15f7e108062d8e8a7c8bc6e0e4b7f12cdb7a23a60ab3211710684f
- MD5 3b6f65a4d4bfe794c7eaa935433e79bb
- SHA1 3dbcf3b6f75bff0c9ef170f8ac7fa2bcd63b9de2
- SHA512 d7b40f6be4f1ee501f22faf03b4f4fbe21a3cd7431dc5fc345b2704861b12df4f573e37d78a000c1206ad1139f43103fad4aaa4b26aaa83ced1d49028a078580
- SSDEEP 49152:BqvLlGtlqhwVwASOxOpuL6aqmmPMMdJU/VQa+0bcjc0tOPwF+YFCrLgUzBNRKsYL:B4lB6POTo0tOPIRQBWsYy+Nf
- TLSH T101466BA9A6B800D5E86A81B88286D233D771BC1517B017CF5AD4ADF73F73AD01E7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_3b6f65a4d4bfe794c7eaa935433e79bb_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_3b6f65a4d4bfe794c7eaa935433e79bb_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260618-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_3b6f65a4d4bfe794c7eaa935433e79bb_akira_cobalt-strike_coinminer_glassworm_rusty-stealer_satacom
- Size 5.3MB
- SHA256 7d129423ef15f7e108062d8e8a7c8bc6e0e4b7f12cdb7a23a60ab3211710684f
- MD5 3b6f65a4d4bfe794c7eaa935433e79bb
- SHA1 3dbcf3b6f75bff0c9ef170f8ac7fa2bcd63b9de2
- SHA512 d7b40f6be4f1ee501f22faf03b4f4fbe21a3cd7431dc5fc345b2704861b12df4f573e37d78a000c1206ad1139f43103fad4aaa4b26aaa83ced1d49028a078580
- SSDEEP 49152:BqvLlGtlqhwVwASOxOpuL6aqmmPMMdJU/VQa+0bcjc0tOPwF+YFCrLgUzBNRKsYL:B4lB6POTo0tOPIRQBWsYy+Nf
- TLSH T101466BA9A6B800D5E86A81B88286D233D771BC1517B017CF5AD4ADF73F73AD01E7A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory