General
- Target 2026-07-02_44f4c46b48f7f526878a53a619170fe6_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 3.0MB
- Sample260702-weew8aa19z
- SHA256 551abd05c926bcf3ed202219bdd3ecee08b210665410487bb4d43f5f647f28d4
- MD5 44f4c46b48f7f526878a53a619170fe6
- SHA1 466a1349336401169f50c167d36ed39358ee36b8
- SHA512 463094a5def7bfaa8c2b7e32f9d18182b278453765bb7e940bbd1f8c718750148d6ce19eaeb852c577848eef01a297926b868cc1d2d6e2738ef01d453efc390a
- SSDEEP 49152:Fv0s3K6yDB7iuFM0xzaG5Urfu2SjM8f6Vto9vN/BFPkC:R/4w01/BFPk
- TLSH T113E527217A5A99EDC14AC07483468A72597130DB0F35BAFF44C896393F6AAF51F3C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_44f4c46b48f7f526878a53a619170fe6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_44f4c46b48f7f526878a53a619170fe6_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260629-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_44f4c46b48f7f526878a53a619170fe6_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 3.0MB
- SHA256 551abd05c926bcf3ed202219bdd3ecee08b210665410487bb4d43f5f647f28d4
- MD5 44f4c46b48f7f526878a53a619170fe6
- SHA1 466a1349336401169f50c167d36ed39358ee36b8
- SHA512 463094a5def7bfaa8c2b7e32f9d18182b278453765bb7e940bbd1f8c718750148d6ce19eaeb852c577848eef01a297926b868cc1d2d6e2738ef01d453efc390a
- SSDEEP 49152:Fv0s3K6yDB7iuFM0xzaG5Urfu2SjM8f6Vto9vN/BFPkC:R/4w01/BFPk
- TLSH T113E527217A5A99EDC14AC07483468A72597130DB0F35BAFF44C896393F6AAF51F3C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.