2026-07-14_c21ed1cc79e7e3e4b5b7ce0e668a3bd7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_c21ed1cc79e7e3e4b5b7ce0e668a3bd7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 25.2MB
Sample260714-dlmljac13l
SHA256 2ce36a2562ac0c778f863d7ff72603662ecd637598527b91d0c6932ec7240f36
MD5 c21ed1cc79e7e3e4b5b7ce0e668a3bd7
SHA1 74db657ae3b89207be4f90956bd965489b47aef9
SHA512 9c75637c97066c501dc2789021a012526f6e201cf5c41fa96c58b9e606360c65ab752696ce42992d0e9c25f805019bf1ccc48ce229de3adc21262cdc2184b914
SSDEEP 393216:shm9eYEWUkNMSYb1TCsjqMOifQF9N5u/C9nBhOved:shm9eYEWUkNMSYb1TzD09TBhOW
TLSH
T1BC475A21BB5E9968D09BC47483478AA34A3130DB1B35B9FF449492382F6DBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_c21ed1cc79e7e3e4b5b7ce0e668a3bd7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-14_c21ed1cc79e7e3e4b5b7ce0e668a3bd7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 25.2MB

2026-07-14_c21ed1cc79e7e3e4b5b7ce0e668a3bd7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH c89f166d4f5148057888f2067928fbd1
SHA256 2ce36a2562ac0c778f863d7ff72603662ecd637598527b91d0c6932ec7240f36
MD5 c21ed1cc79e7e3e4b5b7ce0e668a3bd7
SHA1 74db657ae3b89207be4f90956bd965489b47aef9
SHA512 9c75637c97066c501dc2789021a012526f6e201cf5c41fa96c58b9e606360c65ab752696ce42992d0e9c25f805019bf1ccc48ce229de3adc21262cdc2184b914
SSDEEP 393216:shm9eYEWUkNMSYb1TCsjqMOifQF9N5u/C9nBhOved:shm9eYEWUkNMSYb1TzD09TBhOW
TLSH
T1BC475A21BB5E9968D09BC47483478AA34A3130DB1B35B9FF449492382F6DBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12963440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_plus_plus_manager.pdb

kernel32

SetEnvironmentVariableW ReleaseMutex CreateMutexA SwitchToThread ExitProcess GetModuleHandleW FindClose LoadLibraryW CopyFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx CreateThread QueryPerformanceFrequency SetFileTime WriteConsoleW SetLastError GetConsoleOutputCP SleepEx WriteFileEx FreeEnvironmentStringsW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW SetWaitableTimer ReleaseSRWLockExclusive FreeLibrary CompareStringOrdinal AcquireSRWLockExclusive LoadLibraryA RtlVirtualUnwind WaitForMultipleObjects DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException HeapCreate UnmapViewOfFile HeapValidate HeapSize FlushViewOfFile HeapReAlloc HeapCompact HeapDestroy SystemTimeToFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter WakeAllConditionVariable GetModuleHandleA Process32NextW Process32FirstW CreateToolhelp32Snapshot CreateWaitableTimerExW GetEnvironmentVariableW Sleep GetProcAddress LoadLibraryExA CloseHandle HeapAlloc SleepConditionVariableSRW lstrlenW GetCurrentThreadId FormatMessageW GetUserDefaultUILanguage GetQueuedCompletionStatusEx CancelIoEx LCIDToLocaleName MoveFileExW FindFirstFileExW GetFinalPathNameByHandleW InitializeSListHead PostQueuedCompletionStatus GetOverlappedResult FindNextFileW GetTimeZoneInformationForYear GetFileAttributesW CreateFileW GetFileInformationByHandle GetConsoleMode SetFileCompletionNotificationModes OpenProcess TerminateProcess QueryFullProcessImageNameW CreateIoCompletionPort SetHandleInformation WaitForSingleObject SetNamedPipeHandleState GetDiskFreeSpaceW LockFileEx GetFileInformationByHandleEx UnlockFile SetFileInformationByHandle GetCurrentProcess DuplicateHandle CreateEventW FlushFileBuffers GetTickCount GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte GetCurrentProcessId GetFileSize LocalFree GetSystemInfo DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile WriteFile GetFullPathNameW ReadFile AreFileApisANSI SetUnhandledExceptionFilter

advapi32

RegGetValueW RegOpenKeyExW RegQueryValueExW RegCloseKey SystemFunction036 RegCreateKeyW RegDeleteKeyW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegDeleteValueW RegSetValueExW RegEnumValueW

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtReadFile NtWriteFile NtCreateFile NtOpenFile NtCreateNamedPipeFile RtlGetVersion RtlNtStatusToDosError

user32

AdjustWindowRect TranslateAcceleratorW RedrawWindow RegisterClassExW EnumWindows CreateWindowExW SetWindowPos GetMessageA VkKeyScanW DrawTextW GetWindowDC TranslateMessage OffsetRect GetMenuBarInfo DestroyMenu PostQuitMessage DispatchMessageA RemoveMenu AppendMenuW InsertMenuW CheckMenuItem EnumChildWindows SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable CreatePopupMenu CreateMenu DrawMenuBar SetMenu DrawIconEx GetMenuItemInfoW SetTimer DestroyWindow TrackPopupMenu ChangeWindowMessageFilterEx RegisterClassW IsIconic CreateIcon GetKeyboardLayout AdjustWindowRectEx IsWindow ToUnicodeEx MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SystemParametersInfoA GetSystemMetrics SetWindowLongW EnableMenuItem GetSystemMenu SendInput SetForegroundWindow GetWindowThreadProcessId SetWindowTextW GetWindowTextW GetWindowTextLengthW GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible SetWindowDisplayAffinity RegisterTouchWindow PostMessageW KillTimer GetRawInputData EnumDisplayMonitors MonitorFromPoint DestroyIcon ClientToScreen InvalidateRgn ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SetCursorPos RegisterRawInputDevices RegisterWindowMessageA GetWindow SetParent MapWindowPoints SetFocus ShowWindow InvalidateRect UpdateWindow ReleaseDC EnableWindow IsWindowEnabled GetActiveWindow IsProcessDPIAware GetDC GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn GetForegroundWindow SendMessageW GetMessageW SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos GetClientRect GetWindowLongW ScreenToClient LoadCursorW GetUpdateRect MapVirtualKeyW ValidateRect DefWindowProcW PostThreadMessageW PeekMessageW FlashWindowEx DispatchMessageW SetPropW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance CoTaskMemAlloc RevokeDragDrop RegisterDragDrop OleInitialize CoCreateFreeThreadedMarshaler

gdi32

CreateRectRgn CreateSolidBrush CreateDIBSection DeleteObject BitBlt DeleteDC CreateCompatibleDC CombineRgn SetTextColor SetBkMode SelectObject GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

comctl32

TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass DefSubclassProc

shell32

Shell_NotifyIconW SHCreateItemFromParsingName ShellExecuteW DragQueryFileW DragFinish SHAppBarMessage Shell_NotifyIconGetRect SHGetKnownFolderPath

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

bcryptprimitives

ProcessPrng

ws2_32

recv WSASocketW bind WSASend send freeaddrinfo WSACleanup WSAStartup listen ioctlsocket shutdown select getaddrinfo setsockopt WSAIoctl getsockopt closesocket WSAGetLastError getpeername getsockname connect

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 memcpy __std_exception_destroy __std_exception_copy __current_exception_context __current_exception memmove _CxxThrowException memchr __C_specific_handler strrchr strchr _purecall wcsrchr memset memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

roundf round pow floor log fmod trunc __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen wcscmp strspn strcmp strncmp strlen _wcsicmp strcspn

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free _msize realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_exit _register_onexit_function _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _beginthreadex _initterm _endthreadex _initterm_e __p___argc _initialize_onexit_table _c_exit exit _cexit terminate __p___argv _crt_atexit _seh_filter_exe _set_app_type _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_c21ed1cc79e7e3e4b5b7ce0e668a3bd7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

ntdll

user32

ole32

gdi32

dwmapi

shlwapi

api-ms-win-core-synch-l1-2-0

comctl32

shell32

oleaut32

bcryptprimitives

ws2_32

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic