2026-07-10_e96a33a7911b25568621e8b7201eadab_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_e96a33a7911b25568621e8b7201eadab_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom
Size 78.2MB
Sample260710-3p99faft9q
SHA256 ba5be09836c1061bb64f558f8614c1bb463276a026252937c9bdf2d06a530dc5
MD5 e96a33a7911b25568621e8b7201eadab
SHA1 dc32f39c9ca7626691daefcd37fa1eb51a7fd881
SHA512 9a08362c58cbce8b457b178a96c74572df0628fb2584d6d25e05b6c44f648467b327f0a2d79b581617807460bffb4b5727c503634ef7dbec8df43e60e121c928
SSDEEP 1572864:bx+HrqxhpssMkv/yXGKX6EyIUeSLAsRF3aRqq+aXelVsQO:bw+xh+sMkntKVyIY3RF3m+j
TLSH
T1B2082205BB6AA564E08EC47093570A834F2170DB223BA4FF91D551283F9A7F49B3E35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_e96a33a7911b25568621e8b7201eadab_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

File Explorer

2026-07-10_e96a33a7911b25568621e8b7201eadab_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

.exe 78.2MB

2026-07-10_e96a33a7911b25568621e8b7201eadab_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

IMPHASH 093a6cd038fd14a54e7d359b46cb8dab
SHA256 ba5be09836c1061bb64f558f8614c1bb463276a026252937c9bdf2d06a530dc5
MD5 e96a33a7911b25568621e8b7201eadab
SHA1 dc32f39c9ca7626691daefcd37fa1eb51a7fd881
SHA512 9a08362c58cbce8b457b178a96c74572df0628fb2584d6d25e05b6c44f648467b327f0a2d79b581617807460bffb4b5727c503634ef7dbec8df43e60e121c928
SSDEEP 1572864:bx+HrqxhpssMkv/yXGKX6EyIUeSLAsRF3aRqq+aXelVsQO:bw+xh+sMkntKVyIY3RF3m+j
TLSH
T1B2082205BB6AA564E08EC47093570A834F2170DB223BA4FF91D551283F9A7F49B3E35E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6120512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Updater.pdb

kernel32

SetFileTime GetModuleHandleW VirtualProtect LoadLibraryExA FormatMessageW GetDiskFreeSpaceExW GetLastError GetTickCount64 GetConsoleWindow LoadLibraryA HeapAlloc HeapFree GetProcessHeap FreeConsole GetConsoleMode GetConsoleOutputCP Sleep DeleteFileW SetLastError WriteConsoleW GetModuleFileNameW LoadLibraryExW GetProcAddress CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW HeapReAlloc GetSystemTimePreciseAsFileTime GetTempPathW FindClose GlobalLock SetHandleInformation SetFileInformationByHandle GetFileInformationByHandleEx GetPhysicallyInstalledSystemMemory SetFileCompletionNotificationModes GlobalUnlock GetFileInformationByHandle GetModuleHandleA WriteFileEx ReadFileEx CreateFileMappingW MapViewOfFile CancelIo GetSystemInfo GetOverlappedResult GetStdHandle ReadFile GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW SetFilePointerEx CreateIoCompletionPort FindNextFileW PostQueuedCompletionStatus GlobalSize GlobalAlloc GlobalFree GetSystemTimeAsFileTime FreeLibrary GetQueuedCompletionStatusEx DuplicateHandle SetThreadErrorMode CloseHandle GetFinalPathNameByHandleW UnmapViewOfFile SetUnhandledExceptionFilter InitializeSListHead AddVectoredExceptionHandler GetCurrentProcess SetWaitableTimer CreateWaitableTimerExW Process32Next Process32First CreateToolhelp32Snapshot SwitchToThread GetCurrentThreadId GetCurrentThread WideCharToMultiByte GetUserPreferredUILanguages RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WaitForSingleObject MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency CreateThread SleepEx QueryPerformanceCounter ExitProcess CreateEventW CompareStringOrdinal CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW WaitForMultipleObjects GetExitCodeProcess CreateEventA RemoveVectoredExceptionHandler SetThreadStackGuarantee

advapi32

ImpersonateAnonymousToken RevertToSelf GetTokenInformation RegCloseKey RegEnumKeyExW RegQueryValueExW SystemFunction036 RegOpenKeyExW OpenProcessToken

oleaut32

SysStringLen SysFreeString GetErrorInfo

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile

ws2_32

WSAIoctl WSASocketW ioctlsocket connect getsockopt getsockname WSAGetLastError shutdown bind closesocket getpeername WSAStartup WSACleanup getaddrinfo freeaddrinfo send setsockopt recv WSASend

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertOpenStore CertDuplicateStore

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

OpenClipboard GetClipboardData DefWindowProcA RegisterClassExA CreateWindowExA ReleaseDC GetDC DestroyIcon CreateIcon MapVirtualKeyW SetWindowLongW GetCursorPos SendInput CloseClipboard GetWindowLongPtrW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW RegisterRawInputDevices SetWindowLongPtrW ShowWindow MessageBoxW GetSystemMetrics RedrawWindow FlashWindowEx GetClientRect CreateWindowExW RegisterClassExW DestroyWindow MonitorFromPoint ValidateRect SetWindowTextW TrackPopupMenu SetMenuDefaultItem EnableMenuItem PostMessageW GetForegroundWindow GetActiveWindow EmptyClipboard SetWindowPos GetSystemMenu ClientToScreen IsWindowVisible SetClipboardData LoadCursorW SetCursor ReleaseCapture ChangeDisplaySettingsExW GetWindowPlacement SetWindowPlacement GetMonitorInfoW MonitorFromWindow DefWindowProcW GetRawInputData GetWindowLongW GetMenu AdjustWindowRectEx MapVirtualKeyExW GetKeyboardState GetKeyboardLayout ToUnicodeEx TrackMouseEvent ScreenToClient GetTouchInputInfo MonitorFromRect CloseTouchInputHandle GetWindowRect SetCapture SystemParametersInfoA GetClipCursor ClipCursor ShowCursor GetKeyState IsIconic SetForegroundWindow SetWindowDisplayAffinity RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware DestroyCursor RegisterWindowMessageA InvalidateRgn SendMessageW VkKeyScanW

shell32

ShellExecuteW DragQueryFileW DragFinish

gdi32

SelectObject CreateDIBSection SetPixelFormat DeleteDC GetDeviceCaps CreateRectRgn DescribePixelFormat BitBlt GetPixelFormat ChoosePixelFormat SwapBuffers DeleteObject CreateCompatibleDC

opengl32

wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglCreateContext

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

memset memcmp __CxxFrameHandler3 _CxxThrowException __C_specific_handler memcpy __current_exception __current_exception_context memmove

api-ms-win-crt-math-l1-1-0

fmod pow ceil tan round sin cos exp2f exp2 truncf ceilf roundf _hypotf powf tanf fmax fminf acos floor acosf fmaxf fmodf sinf floorf trunc __setusermatherr cosf fmaf atan2

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit strerror _set_app_type _register_thread_local_exe_atexit_callback _crt_atexit __p___argv __p___argc _configure_narrow_argv _exit terminate exit _initterm_e _initterm _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_e96a33a7911b25568621e8b7201eadab_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

kernel32

advapi32

oleaut32

ntdll

ws2_32

bcrypt

crypt32

secur32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

shell32

gdi32

opengl32

d3dcompiler_47

ole32

imm32

uxtheme

dwmapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic