2026-07-11_2f98c7a63264e13054f9a2535a0c712d_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_2f98c7a63264e13054f9a2535a0c712d_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 2.6MB
Sample260711-vbvb3ahs9s
SHA256 b36b132b5d8a5f3a3239302f8ca730c4a76f8abf4783cd670a5f4fd7a35a32c9
MD5 2f98c7a63264e13054f9a2535a0c712d
SHA1 2e8a2a6e4775d89e51d8465d9a4b6e56040a6b9e
SHA512 135fbea6219cf6d252fe86fbc0d8def53e1e87461db8c8ff3daf2f2b176cd017ccb0332395fd4330046e067f152844ab416fe08b49e988bb3ae7c3cc83f6b43e
SSDEEP 49152:kMnxytwSJNrKzpmKBA8/8yp2ggP4ZQTAIzHY2uR:kMnMKzAoBxIm
TLSH
T1A3C59E03E7A580EAD49AC138C7568223FB72B4891730B6EF57D48A253F67BA15F1D305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_2f98c7a63264e13054f9a2535a0c712d_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-07-11_2f98c7a63264e13054f9a2535a0c712d_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 2.6MB

2026-07-11_2f98c7a63264e13054f9a2535a0c712d_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH a9cfe4d59b4347e623a95ee9979ae52c
SHA256 b36b132b5d8a5f3a3239302f8ca730c4a76f8abf4783cd670a5f4fd7a35a32c9
MD5 2f98c7a63264e13054f9a2535a0c712d
SHA1 2e8a2a6e4775d89e51d8465d9a4b6e56040a6b9e
SHA512 135fbea6219cf6d252fe86fbc0d8def53e1e87461db8c8ff3daf2f2b176cd017ccb0332395fd4330046e067f152844ab416fe08b49e988bb3ae7c3cc83f6b43e
SSDEEP 49152:kMnxytwSJNrKzpmKBA8/8yp2ggP4ZQTAIzHY2uR:kMnMKzAoBxIm
TLSH
T1A3C59E03E7A580EAD49AC138C7568223FB72B4891730B6EF57D48A253F67BA15F1D305
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1840500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

update.pdb

kernel32

EncodePointer CreateWaitableTimerExW SetWaitableTimer FlsFree FlsSetValue PostQueuedCompletionStatus FlsGetValue FlsAlloc LoadLibraryExA DuplicateHandle GetModuleFileNameW CopyFileExW GetStartupInfoW GetFileAttributesW CreateProcessW DeleteFileW GetWindowsDirectoryW ReadFile GetOverlappedResult CancelIo CreateEventW RtlPcToFileHeader GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileTime CreateFileW GetFullPathNameW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetHandleInformation ExitProcess TerminateProcess IsProcessorFeaturePresent WriteFileEx GetTempPathW ReadFileEx HeapAlloc IsDebuggerPresent ReleaseMutex CreateMutexA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentThreadId GetFileType GetModuleHandleW SetFilePointerEx SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError FormatMessageW SwitchToThread HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee LoadLibraryA VirtualAlloc VirtualFreeEx VirtualFree ResumeThread CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess CreateProcessA FlushInstructionCache GetCurrentProcess VirtualQuery GetSystemDirectoryW GetModuleHandleA SleepEx WaitForMultipleObjects GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryExW GetComputerNameExW Sleep VirtualProtect LocalFree GetExitCodeProcess WaitForSingleObject CloseHandle GetSystemTimePreciseAsFileTime GetLastError FindClose FindNextFileW SetFileInformationByHandle GetTimeZoneInformationForYear GetStringTypeW SetStdHandle GetCPInfo QueryPerformanceFrequency GetEnvironmentVariableW GetOEMCP WriteConsoleW SetEnvironmentVariableW LoadLibraryW QueryPerformanceCounter DeleteCriticalSection TryEnterCriticalSection GetEnvironmentStringsW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException AreFileApisANSI GetACP HeapCreate WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW UnmapViewOfFile HeapValidate HeapSize GetTempPathA IsValidCodePage GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA DeleteFileA GetSystemInfo MultiByteToWideChar HeapCompact HeapDestroy UnlockFile FreeEnvironmentStringsW LCMapStringW CompareStringW LockFileEx GetFileSize CompareStringOrdinal FlushFileBuffers FreeConsole GetCommandLineW AddVectoredExceptionHandler GetTimeZoneInformation UnhandledExceptionFilter GetCommandLineA InitializeCriticalSectionEx RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead SystemTimeToFileTime GetSystemTimeAsFileTime lstrlenW WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP GetSystemTime FormatMessageA CreateFileMappingW GetTickCount MapViewOfFile

ws2_32

WSASocketW getsockopt select WSAStartup WSACleanup shutdown getpeername WSAIoctl WSADuplicateSocketW getaddrinfo freeaddrinfo WSASend getsockname listen bind recv connect setsockopt closesocket accept WSAGetLastError send ioctlsocket

crypt32

CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertDuplicateStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertFreeCertificateContext CryptUnprotectData

advapi32

SystemFunction036 GetUserNameW RegOpenKeyExW RegDeleteValueW RegSetValueExW RegQueryValueExW RegCloseKey

iphlpapi

GetAdaptersAddresses GetIpForwardTable

ntdll

NtWriteFile NtCreateFile NtReadFile NtOpenFile NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

secur32

DecryptMessage ApplyControlToken AcquireCredentialsHandleA DeleteSecurityContext EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW FreeCredentialsHandle

bcryptprimitives

ProcessPrng

oleaut32

SysStringLen GetErrorInfo SysFreeString

user32

EnumDisplaySettingsExW GetAsyncKeyState EnumDisplayMonitors GetMonitorInfoW

gdi32

GetDIBits StretchBlt SetStretchBltMode CreateDCW DeleteObject CreateCompatibleBitmap GetDeviceCaps DeleteDC CreateCompatibleDC GetObjectW SelectObject

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

675KB

Virtual Size

675KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_2f98c7a63264e13054f9a2535a0c712d_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

kernel32

ws2_32

crypt32

advapi32

iphlpapi

ntdll

api-ms-win-core-synch-l1-2-0

bcrypt

secur32

bcryptprimitives

oleaut32

user32

gdi32

generic