2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 12.5MB
Sample260714-e2k83sgv3v
SHA256 4364d88a23fd2c3dc73b7fc9c4ac946efddc774d96fedae03c523de8c2611e32
MD5 19c66f5ea24ac46ae98d153946c5d47b
SHA1 0ab5d0e62e89bdc611454f905d5b2a36b31e4fda
SHA512 1954c35d0b8305e7eb4a3ad1f40370422c0218ab2a278f835fc67f5de7a2eea543c15f9a67ec2c0cc9f48b225caa0c34fab8af9712551e072ea7983c665fca8b
SSDEEP 98304:u0CqTKI589MrSBZ0M8z0t/6zBi8nfVQT+f4o+oxfViC0Wq+NAqxJXa:H+IlrZzB3AoxfZ0JlI
TLSH
T1BED639127A9E55ACC1AAC47483474A735A3130CB1B35B9FF54C892793FBAAF45A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 12.5MB

2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d73b5a92b56115e88b656a3ef45b076d
SHA256 4364d88a23fd2c3dc73b7fc9c4ac946efddc774d96fedae03c523de8c2611e32
MD5 19c66f5ea24ac46ae98d153946c5d47b
SHA1 0ab5d0e62e89bdc611454f905d5b2a36b31e4fda
SHA512 1954c35d0b8305e7eb4a3ad1f40370422c0218ab2a278f835fc67f5de7a2eea543c15f9a67ec2c0cc9f48b225caa0c34fab8af9712551e072ea7983c665fca8b
SSDEEP 98304:u0CqTKI589MrSBZ0M8z0t/6zBi8nfVQT+f4o+oxfViC0Wq+NAqxJXa:H+IlrZzB3AoxfZ0JlI
TLSH
T1BED639127A9E55ACC1AAC47483474A735A3130CB1B35B9FF54C892793FBAAF45A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8418112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_plus_plus.pdb

kernel32

CreateEventW GetSystemTime DuplicateHandle GetCurrentProcess SetFileInformationByHandle UnlockFile GetFileInformationByHandleEx LockFileEx GetDiskFreeSpaceW GetProcAddress CreateFileW lstrlenW WideCharToMultiByte GetCurrentProcessId GetFileSize LocalFree LoadLibraryW GetSystemInfo DeleteFileW DeleteFileA WaitForSingleObjectEx QueryFullProcessImageNameW SetNamedPipeHandleState LoadLibraryA TerminateProcess WaitForSingleObject GetTickCount CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep MultiByteToWideChar GetFileAttributesW FormatMessageW LoadLibraryExA GetLastError CreateMutexW GetTempPathW GetTimeZoneInformationForYear UnlockFileEx SetEndOfFile GetFullPathNameA FreeLibrary HeapAlloc GetQueuedCompletionStatusEx CancelIoEx PostQueuedCompletionStatus HeapFree GetProcessHeap GetOverlappedResult SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation CloseHandle OpenProcess FlushFileBuffers RegisterWaitForSingleObject UnregisterWaitEx GetCurrentThreadId AreFileApisANSI ReadFile GetFullPathNameW WriteFile LockFile GetSystemTimeAsFileTime SetFilePointer GetModuleHandleA WaitForMultipleObjects GetModuleHandleW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW GetExitCodeProcess GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx CreateThread QueryPerformanceFrequency SetFileTime MoveFileExW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal RtlVirtualUnwind DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter InitializeCriticalSection RaiseException HeapCreate OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize OutputDebugStringW FlushViewOfFile HeapReAlloc HeapCompact HeapDestroy SystemTimeToFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter Process32NextW Process32FirstW CreateToolhelp32Snapshot FindNextFileW InitializeSListHead CreateProcessW EnterCriticalSection

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW SystemFunction036

oleaut32

GetErrorInfo SysStringLen SysFreeString SysAllocStringLen

ws2_32

freeaddrinfo WSAGetLastError socket select getaddrinfo WSAStartup WSACleanup WSAIoctl setsockopt shutdown listen bind WSASocketW send recv connect ioctlsocket WSASend accept getsockopt getsockname getpeername closesocket

ole32

PropVariantClear CoInitializeEx CoUninitialize CoCreateInstance

shell32

SHGetPropertyStoreForWindow SHGetKnownFolderPath ShellExecuteW ExtractIconExW

combase

CoTaskMemFree

user32

IsWindowVisible GetWindowThreadProcessId SendMessageW EnumWindows IsIconic ShowWindow SetForegroundWindow

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtReadFile NtWriteFile NtCreateNamedPipeFile NtOpenFile

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 memcpy memcmp memmove memset strchr strrchr __C_specific_handler memchr __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-string-l1-1-0

strcspn strspn strcmp strlen strncmp

api-ms-win-crt-math-l1-1-0

pow fmod log __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc realloc free _set_new_mode _msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _initterm_e _initterm _initialize_narrow_environment _register_onexit_function _crt_atexit _exit __p___argc _set_app_type _register_thread_local_exe_atexit_callback _initialize_onexit_table _c_exit _endthreadex exit _beginthreadex __p___argv _configure_narrow_argv _cexit _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_19c66f5ea24ac46ae98d153946c5d47b_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

advapi32

oleaut32

ws2_32

ole32

shell32

combase

user32

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic