2026-07-08_66b56a92a693579aa8cb503e9fc7afec_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_66b56a92a693579aa8cb503e9fc7afec_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 5.1MB
Sample260708-e6542sbw6j
SHA256 64797fe2965fe2615e0412e9f686e89fd36c087a31a64f810c994d26f0936190
MD5 66b56a92a693579aa8cb503e9fc7afec
SHA1 0568da5a236e7750e7e3d0838fdb9c2f5fa9e72c
SHA512 f2567e7c34aab2059cd271ccf87ec21d94580b8449ccac6a5a548a3fcb77e0d84339f5a3a0fd7b31b22ab41c0f2dd58d13f1e3f9660d325609c5aa1eb7582d0f
SSDEEP 49152:0ME+fzljJz25KsjnCkOamAgTXMbWPi+IuDYMelUAFdN2hpI12JpIU6iQeDwBRvVj:0MtlJDTZi6t1JO+QeYV9
TLSH
T103364A217A5A98EDC55AC47483868AB2693630CB0F35B9FF44C482793F69EF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_66b56a92a693579aa8cb503e9fc7afec_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-08_66b56a92a693579aa8cb503e9fc7afec_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 5.1MB

2026-07-08_66b56a92a693579aa8cb503e9fc7afec_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 5ac77564c3471c7c2ff8435f25268fc1
SHA256 64797fe2965fe2615e0412e9f686e89fd36c087a31a64f810c994d26f0936190
MD5 66b56a92a693579aa8cb503e9fc7afec
SHA1 0568da5a236e7750e7e3d0838fdb9c2f5fa9e72c
SHA512 f2567e7c34aab2059cd271ccf87ec21d94580b8449ccac6a5a548a3fcb77e0d84339f5a3a0fd7b31b22ab41c0f2dd58d13f1e3f9660d325609c5aa1eb7582d0f
SSDEEP 49152:0ME+fzljJz25KsjnCkOamAgTXMbWPi+IuDYMelUAFdN2hpI12JpIU6iQeDwBRvVj:0MtlJDTZi6t1JO+QeYV9
TLSH
T103364A217A5A98EDC55AC47483868AB2693630CB0F35B9FF44C482793F69EF51F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3353200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

regbot.pdb

kernel32

GetCurrentProcess CreateEventW WaitForSingleObject GetCurrentThread CreateFileW GetConsoleMode GetCurrentProcessId LocalFree GetDiskFreeSpaceExW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetVolumePathNamesForVolumeNameW GetProcessTimes GetDriveTypeW GetVolumeInformationW DeviceIoControl GetExitCodeProcess OpenProcess GetSystemTimes GetProcessIoCounters SetHandleInformation PostQueuedCompletionStatus GetOverlappedResult CloseHandle ReadFile CreateMutexW CreateIoCompletionPort GetQueuedCompletionStatusEx SetFileCompletionNotificationModes Sleep GetLastError GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW SetUnhandledExceptionFilter GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx SwitchToThread FindClose FindFirstFileExW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler GetStdHandle CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime GetModuleHandleW RtlCaptureContext DuplicateHandle ReadFileEx CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal RtlVirtualUnwind ReadProcessMemory VirtualQueryEx K32GetPerformanceInfo GlobalMemoryStatusEx GetSystemInfo GlobalUnlock MultiByteToWideChar WideCharToMultiByte GlobalSize GlobalLock FormatMessageW HeapFree HeapAlloc GetProcessHeap GetProcAddress GetComputerNameExW GetModuleFileNameW WaitForMultipleObjects GetModuleHandleA FindNextFileW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry lstrlenW

ws2_32

recv WSASend send getsockname getpeername freeaddrinfo setsockopt ioctlsocket WSAIoctl WSASocketW bind shutdown WSAStartup connect WSACleanup WSAGetLastError closesocket getaddrinfo getsockopt

advapi32

GetTokenInformation GetUserNameW CopySid ImpersonateAnonymousToken GetLengthSid IsValidSid RevertToSelf OpenProcessToken SystemFunction036 RegEnumKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW

oleaut32

GetErrorInfo

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtOpenFile NtQuerySystemInformation NtCreateNamedPipeFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile NtQueryInformationProcess RtlGetVersion NtReadFile

bcryptprimitives

ProcessPrng

user32

CloseClipboard GetClipboardData ReleaseDC GetClientRect GetDC OpenClipboard GetDesktopWindow

gdi32

DeleteDC GetDIBits CreateCompatibleBitmap CreateCompatibleDC DeleteObject BitBlt SelectObject

dxgi

CreateDXGIFactory1

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

pdh

PdhCollectQueryData PdhOpenQueryA PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue

powrprof

CallNtPowerInformation

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfTable2

psapi

GetModuleFileNameExW

bcrypt

BCryptGenRandom

vcruntime140

__current_exception __current_exception_context memcmp memcpy memset _CxxThrowException __C_specific_handler memmove __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _initialize_onexit_table strerror _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_66b56a92a693579aa8cb503e9fc7afec_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

ws2_32

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

user32

gdi32

dxgi

shell32

ole32

pdh

powrprof

iphlpapi

psapi

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic