Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_bf29ed8325edc49089ef1470b9394f67_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_bf29ed8325edc49089ef1470b9394f67_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260630-en
2 signatures
150 seconds
General
- Target 2026-07-04_bf29ed8325edc49089ef1470b9394f67_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe
- Size 25.6MB
- Sample260704-za5tmahs7m
- SHA256 1ea1a960acf879d6244e89ee975cd19df6d4f91c0a15976e5cd28f377cc31770
- MD5 bf29ed8325edc49089ef1470b9394f67
- SHA1 905753180a675d4784a3a42ac6acb8ca8b3cdb0f
- SHA512 8621fba142c4bc7f6f4949e9280b48f5eac158110d5abf407eaf6a77845582bf0055b073e86e7b2179c49cb5d9b5d4affa8110696a621a65cbf6601c146786ba
- SSDEEP 98304:v7oas2OKwAhxg3c/Zl9oKqJNvQEZVfGD6k+stXjQ9g9xI/Z91FMiMGM3UPTRBzU+:zKKtxgs/eK6zFi361Bz71/
- TLSH T1FE47D72A667894DAD17BC0B8D2939F217E21709A07392FF745D0827A2F24EF86D3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wuhost.exe 2026-07-04_bf29ed8325edc49089ef1470b9394f67_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 3 discord.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_bf29ed8325edc49089ef1470b9394f67_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_bf29ed8325edc49089ef1470b9394f67_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe"1⤵
- Drops startup file
PID:5524