2026-07-14_7bf3a36b75029cd96b602d61778e751e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_7bf3a36b75029cd96b602d61778e751e_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 14.5MB
Sample260714-d65b3sdw2l
SHA256 d852447fdbb56b958da2c110ff26c64b045715129235055ff48dd6d2d9831a41
MD5 7bf3a36b75029cd96b602d61778e751e
SHA1 55d3c459f6f6fa38618e0a0cdce98c24b69b2a4d
SHA512 bb37ec2773207173347b3195527617b8cc8c349cf6a04b219f215576e2e29fbdde7be4c0db2eb3aac02f83a97d0784df9d906d04af9b09b183014274bb1590c9
SSDEEP 98304:A0WooMcFLETVIFSZCp82OHFE+GOgolZ90bz3rBIc9tBesn5bZiT1Dl+llVlWoOmN:XyETVce5990bz3rBF3Bes5bg5JMlROmN
TLSH
T12FE66B16B6AA54ECC49AC4B4C35A8633AA3178CA0B3579FF45D492353F6AAF01F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-14_7bf3a36b75029cd96b602d61778e751e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-14_7bf3a36b75029cd96b602d61778e751e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 14.5MB

2026-07-14_7bf3a36b75029cd96b602d61778e751e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH a6549ec4e0931b83929d5fcd0fd37bb2
SHA256 d852447fdbb56b958da2c110ff26c64b045715129235055ff48dd6d2d9831a41
MD5 7bf3a36b75029cd96b602d61778e751e
SHA1 55d3c459f6f6fa38618e0a0cdce98c24b69b2a4d
SHA512 bb37ec2773207173347b3195527617b8cc8c349cf6a04b219f215576e2e29fbdde7be4c0db2eb3aac02f83a97d0784df9d906d04af9b09b183014274bb1590c9
SSDEEP 98304:A0WooMcFLETVIFSZCp82OHFE+GOgolZ90bz3rBIc9tBesn5bZiT1Dl+llVlWoOmN:XyETVce5990bz3rBF3Bes5bg5JMlROmN
TLSH
T12FE66B16B6AA54ECC49AC4B4C35A8633AA3178CA0B3579FF45D492353F6AAF01F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
UPX dump on OEP (original entry point)
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d3:30:b7:b3:fc:00:db:e8:e6:10:fb:39:14:f1:0e:70:c4:93:5f:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Cloud.com\, Inc.,O=Cloud.com\, Inc.,L=Cupertino,ST=CA,C=US

Chains

Jul 7, 2026

CN=Cloud.com\, Inc.,O=Cloud.com\, Inc.,L=Cupertino,ST=CA,C=US

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

03:01

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 16, 2006 - Nov 16, 2026

Subject

CN=Cloud.com\, Inc.,O=Cloud.com\, Inc.,L=Cupertino,ST=CA,C=US

Serial Number

4f:1b:e4:6d:9f:d4:c9

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2011 - Mar 7, 2014

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

9469680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tester.pdb

kernel32

SetThreadErrorMode FormatMessageW CreateNamedPipeW ConnectNamedPipe PeekNamedPipe ReadFile HeapAlloc GetProcessHeap RtlVirtualUnwind FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId IsWow64Process GetConsoleWindow Sleep LoadLibraryExA GlobalMemoryStatusEx K32GetPerformanceInfo QueryPerformanceFrequency QueryPerformanceCounter CreateEventA LoadLibraryA GetModuleHandleA RemoveVectoredExceptionHandler AddVectoredExceptionHandler GetCurrentProcessId OpenProcess VirtualQueryEx GetProcessTimes LoadLibraryW FreeLibrary GetCurrentProcess TerminateProcess CreateProcessW GetExitCodeThread WaitForSingleObject GetModuleHandleW InitializeSListHead CloseHandle GetProcAddress GetComputerNameExW GetExitCodeProcess GetLastError FindFirstVolumeW FindNextVolumeW FindVolumeClose GetVolumePathNamesForVolumeNameW GetDriveTypeW GetVolumeInformationW DeviceIoControl GetDiskFreeSpaceExW GetSystemTimes GetProcessIoCounters LoadLibraryExW ReadProcessMemory GetModuleFileNameW SetUnhandledExceptionFilter HeapFree FindNextFileW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW ReleaseMutex CreateMutexA SwitchToThread CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime lstrlenW GetEnvironmentVariableW GetCurrentDirectoryW CreateThread GetCurrentThread SetThreadStackGuarantee GetStdHandle SetHandleInformation GetWindowsDirectoryW ReadFileEx DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetEnvironmentStringsW GetFileInformationByHandle GetFileInformationByHandleEx

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

ReleaseDC GetWindowDC EnumDisplaySettingsW EnumDisplayMonitors GetMonitorInfoW GetClientRect DestroyWindow DefWindowProcA RegisterClassExA GetClassInfoExA GetDC CreateWindowExA ShowWindow GetDesktopWindow

gdi32

CreateCompatibleDC DescribePixelFormat GetDIBits CreateCompatibleBitmap DeleteObject SelectObject SwapBuffers DeleteDC GetPixelFormat BitBlt ChoosePixelFormat SetPixelFormat

advapi32

RegGetValueW RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW GetLengthSid IsValidSid CopySid OpenProcessToken GetTokenInformation SystemFunction036

psapi

GetProcessMemoryInfo GetModuleFileNameExW

oleaut32

SysFreeString SysStringLen VariantClear SetErrorInfo SafeArrayUnaccessData SafeArrayAccessData GetErrorInfo SysAllocStringLen

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity

combase

CoIncrementMTAUsage

opengl32

wglMakeCurrent wglGetProcAddress wglDeleteContext wglCreateContext wglGetCurrentContext

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

ws2_32

WSAStartup recv freeaddrinfo getsockopt WSACleanup getsockname getaddrinfo send getpeername WSARecv WSASend connect WSAGetLastError select setsockopt WSASocketW ioctlsocket WSADuplicateSocketW accept bind listen closesocket

shell32

CommandLineToArgvW

pdh

PdhGetFormattedCounterValue PdhOpenQueryA PdhAddEnglishCounterW PdhCloseQuery PdhRemoveCounter PdhCollectQueryData

powrprof

CallNtPowerInformation

ntdll

NtQueryInformationProcess NtCreateNamedPipeFile NtQuerySystemInformation NtWriteFile RtlGetVersion NtOpenFile NtReadFile RtlNtStatusToDosError

vcruntime140

memchr _CxxThrowException __current_exception __C_specific_handler strrchr memset memcmp memmove memcpy strchr __CxxFrameHandler3 __current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen strcspn strspn strcmp strncmp strlen

api-ms-win-crt-math-l1-1-0

expf log tanh sin exp floor exp2f exp2 coshf logf floorf atan2f atan2 ceil _hypot powf _hypotf tanf __setusermatherr log1pf trunc tan cosh sinf fma fmaf roundf acosf log1p log2f pow truncf ceilf log2 tanhf sinh atanf cosf atan cos acos sinhf asinf fmodf fmod round asin

api-ms-win-crt-heap-l1-1-0

malloc free _msize realloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_endthreadex _beginthreadex _initialize_onexit_table _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _register_onexit_function _c_exit _register_thread_local_exe_atexit_callback _crt_atexit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

324KB

Virtual Size

323KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fgprnt

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

872B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_7bf3a36b75029cd96b602d61778e751e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

user32

gdi32

advapi32

psapi

oleaut32

ole32

combase

opengl32

setupapi

bcryptprimitives

bcrypt

iphlpapi

ws2_32

shell32

pdh

powrprof

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic