2026-07-14_15c967b043d7997fa7c35440b4f67e8f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_15c967b043d7997fa7c35440b4f67e8f_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 12.5MB
Sample260714-e367yagv6z
SHA256 48f81e393d48ed5e3716fead935e61b2f256df22d30a715401227c4ed05a8e16
MD5 15c967b043d7997fa7c35440b4f67e8f
SHA1 6156141d73aa704ce21b093b3b9a4329f54c00da
SHA512 39b3d46f305f71d3955c0ec46bc1aab683c354bc02c2aeb4650e69399323673a889169ba5a047426742b928264de349edab1b2d2023522c96060d11a38281973
SSDEEP 98304:WZ9mXxW6O5AwdEacFBgy9XSOGKsThhrscw2QDRoxfWiC3kt+KsLmNKMn3:TXUpqLGKYOzoxfC8ITE
TLSH
T17DD639127A9E55ACC1AAC47483474A735A3130CB1B35B9FF54C892793FBAAF45A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_15c967b043d7997fa7c35440b4f67e8f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-14_15c967b043d7997fa7c35440b4f67e8f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 12.5MB

2026-07-14_15c967b043d7997fa7c35440b4f67e8f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 92415007ec3274a2cf22d3d0aa47e7bd
SHA256 48f81e393d48ed5e3716fead935e61b2f256df22d30a715401227c4ed05a8e16
MD5 15c967b043d7997fa7c35440b4f67e8f
SHA1 6156141d73aa704ce21b093b3b9a4329f54c00da
SHA512 39b3d46f305f71d3955c0ec46bc1aab683c354bc02c2aeb4650e69399323673a889169ba5a047426742b928264de349edab1b2d2023522c96060d11a38281973
SSDEEP 98304:WZ9mXxW6O5AwdEacFBgy9XSOGKsThhrscw2QDRoxfWiC3kt+KsLmNKMn3:TXUpqLGKYOzoxfC8ITE
TLSH
T17DD639127A9E55ACC1AAC47483474A735A3130CB1B35B9FF54C892793FBAAF45A3C318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8425168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codex_plus_plus.pdb

kernel32

CreateEventW GetSystemTime DuplicateHandle GetCurrentProcess SetFileInformationByHandle UnlockFile GetFileInformationByHandleEx LockFileEx GetDiskFreeSpaceW GetProcAddress CreateFileW lstrlenW WideCharToMultiByte GetCurrentProcessId GetFileSize LocalFree LoadLibraryW GetSystemInfo DeleteFileW DeleteFileA QueryFullProcessImageNameW SetNamedPipeHandleState WaitForSingleObjectEx LoadLibraryA TerminateProcess WaitForSingleObject GetTickCount CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep MultiByteToWideChar GetFileAttributesW FormatMessageW LoadLibraryExA GetLastError CreateMutexW GetTempPathW GetTimeZoneInformationForYear UnlockFileEx SetEndOfFile GetFullPathNameA FreeLibrary HeapAlloc GetQueuedCompletionStatusEx CancelIoEx PostQueuedCompletionStatus HeapFree GetProcessHeap GetOverlappedResult SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation CloseHandle OpenProcess FlushFileBuffers RegisterWaitForSingleObject UnregisterWaitEx GetCurrentThreadId AreFileApisANSI ReadFile GetFullPathNameW WriteFile LockFile GetSystemTimeAsFileTime SetFilePointer GetModuleHandleA WaitForMultipleObjects GetModuleHandleW SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW GetExitCodeProcess GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx CreateThread QueryPerformanceFrequency SetFileTime MoveFileExW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal RtlVirtualUnwind DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter InitializeCriticalSection RaiseException HeapCreate OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize OutputDebugStringW FlushViewOfFile HeapReAlloc HeapCompact HeapDestroy SystemTimeToFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter Process32NextW Process32FirstW CreateToolhelp32Snapshot FindNextFileW InitializeSListHead CreateProcessW EnterCriticalSection

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW SystemFunction036

oleaut32

GetErrorInfo SysStringLen SysFreeString SysAllocStringLen

ws2_32

freeaddrinfo WSAGetLastError socket select getaddrinfo WSAStartup WSACleanup WSAIoctl setsockopt shutdown listen bind WSASocketW send recv connect ioctlsocket WSASend accept getsockopt getsockname getpeername closesocket

ole32

PropVariantClear CoInitializeEx CoUninitialize CoCreateInstance

shell32

SHGetPropertyStoreForWindow ExtractIconExW SHGetKnownFolderPath ShellExecuteW

combase

CoTaskMemFree

user32

SetForegroundWindow IsWindowVisible GetWindowThreadProcessId SendMessageW EnumWindows IsIconic ShowWindow

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtReadFile NtWriteFile NtCreateNamedPipeFile NtOpenFile

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 memcpy memcmp memmove memset strchr strrchr __C_specific_handler memchr __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-string-l1-1-0

strcspn strspn strcmp strlen strncmp

api-ms-win-crt-math-l1-1-0

pow fmod log __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc realloc free _set_new_mode _msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _initterm_e _initterm _initialize_narrow_environment _register_onexit_function _crt_atexit _exit __p___argc _set_app_type _register_thread_local_exe_atexit_callback _initialize_onexit_table _c_exit _endthreadex exit _beginthreadex __p___argv _configure_narrow_argv _cexit _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_15c967b043d7997fa7c35440b4f67e8f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

bcryptprimitives

advapi32

oleaut32

ws2_32

ole32

shell32

combase

user32

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic