Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe
- Size 11.6MB
- Sample260710-depsbadv8s
- SHA256 a2c2f216a53bca34657e958ac4a950765bb7552a9ed261b7de3d2cda3b7c5721
- MD5 4e77315899acd6270ec46b56851d45c7
- SHA1 c1820f58007078291c51a34769f850e6e32ae435
- SHA512 11ee07318ac41da05f67dfe6afd1ff504dfe47a25e92417d87fcea9992700ddc1684af4ce057437ead6b8ba3e4870d096ec6ee9baf66af802d1808710188906c
- SSDEEP 196608:rqNgXSggQCxhSzb53qoJVxQLindotDLab7YIzgd/XE99uQHNkxcoaMu:r6gXSggQv9qoJVxQLindo9La/YIzgd/O
- TLSH T15CC68E1B76AC01D8E1BBC2BCCA974A17E7B2741903319BCF06D486A91F17EE45A3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 2348 2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe 2348 2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2348 2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe 2348 2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_4e77315899acd6270ec46b56851d45c7_akira_cobalt-strike_coinminer_glassworm_helldown_satacom_stealc.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2348