2026-07-17_c46075751f483c5ddaf0b692e021f596_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_c46075751f483c5ddaf0b692e021f596_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 33.7MB
Sample260718-cms92acz4n
SHA256 00bf97d04385d40c0a4c6f05715872c0c9d7639485edd6f025cd0a139a2bbb34
MD5 c46075751f483c5ddaf0b692e021f596
SHA1 970407bcb76517bf5558ce3af5d701058d65336b
SHA512 682c74a2e47a17513a8e378c25f8ae34f57bfc07ecf32baf3382a74f29038b3352308ab6a523a01f4ebfa34bc82371bd03fe8e26fde8e51336f6e9bedb517f26
SSDEEP 393216:e2mxy8oNDK0dteoa6FWPE1wQzdM2k0vlVIOL:DOyF1ltez6FCIwQzdM2k09V
TLSH
T1497719067A9F99ADE09AC874C30A8A735F2130DB1626B8BF40C455353FADBB05B3D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_c46075751f483c5ddaf0b692e021f596_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-17_c46075751f483c5ddaf0b692e021f596_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 33.7MB

2026-07-17_c46075751f483c5ddaf0b692e021f596_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 3abda01631627df2319840ba37dfa983
SHA256 00bf97d04385d40c0a4c6f05715872c0c9d7639485edd6f025cd0a139a2bbb34
MD5 c46075751f483c5ddaf0b692e021f596
SHA1 970407bcb76517bf5558ce3af5d701058d65336b
SHA512 682c74a2e47a17513a8e378c25f8ae34f57bfc07ecf32baf3382a74f29038b3352308ab6a523a01f4ebfa34bc82371bd03fe8e26fde8e51336f6e9bedb517f26
SSDEEP 393216:e2mxy8oNDK0dteoa6FWPE1wQzdM2k0vlVIOL:DOyF1ltez6FCIwQzdM2k09V
TLSH
T1497719067A9F99ADE09AC874C30A8A735F2130DB1626B8BF40C455353FADBB05B3D719
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26689136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agent_doc.pdb

kernel32

SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW ReadConsoleW CreateDirectoryW ExitProcess WaitForMultipleObjects GetOverlappedResult CreateEventW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW WaitNamedPipeW GetTempPathW DeleteFileW GetFinalPathNameByHandleW LocalAlloc MoveFileExW CreateSymbolicLinkW LocalFree FreeLibrary WriteFile ReadFile SetHandleInformation DisconnectNamedPipe GetNamedPipeInfo GetFileType GetConsoleScreenBufferInfo LoadLibraryW SetConsoleTextAttribute SetConsoleMode GetFullPathNameW MapViewOfFile CreateFileMappingW FormatMessageA CreateNamedPipeW GetSystemTimeAsFileTime GetFileSize HeapDestroy HeapCompact GetSystemInfo GetNativeSystemInfo DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW FormatMessageW HeapAlloc GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException GetConsoleMode SetWaitableTimer CreateWaitableTimerExW CreatePipe GetTickCount SetNamedPipeHandleState QueryPerformanceFrequency QueryPerformanceCounter AddVectoredExceptionHandler SetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW ExpandEnvironmentStringsW GetProcessId GetSystemTime RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW lstrlenW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW CompareStringOrdinal GetCommandLineW SetCurrentDirectoryW SystemTimeToFileTime InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ConnectNamedPipe DuplicateHandle GetCurrentProcess FlushFileBuffers LockFileEx UnlockFile ReadFileEx GetCurrentThread SetThreadStackGuarantee FindNextFileW DeviceIoControl OpenProcess GetStdHandle SetFileAttributesW GetExitCodeProcess WriteFileEx WriteConsoleW SleepEx SetErrorMode GetModuleHandleW SetFilePointerEx WaitForSingleObject GetCurrentProcessId CreateThread CreateSemaphoreW UnlockFileEx CancelIo GetConsoleOutputCP WaitForSingleObjectEx GetSystemTimePreciseAsFileTime SwitchToThread HeapReAlloc ReleaseMutex CreateMutexA FindClose LoadLibraryA RtlLookupFunctionEntry SetLastError TerminateProcess CreateProcessW HeapFree DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList ReadDirectoryChangesW GetProcessHeap GetCurrentThreadId SetEndOfFile ReleaseSemaphore InitializeSListHead GetProcAddress GetModuleHandleA Sleep GetLastError CopyFileExW CloseHandle SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ws2_32

bind WSADuplicateSocketW accept freeaddrinfo getaddrinfo getsockname setsockopt ioctlsocket WSASocketW WSACleanup WSAStartup select listen send recv getsockopt closesocket WSAGetLastError shutdown connect getpeername

advapi32

SetSecurityDescriptorGroup FreeSid IsValidSid GetSidSubAuthorityCount GetAclInformation RegEnumValueW GetSidLengthRequired SystemFunction036 CopySid InitializeAcl GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetAce SetSecurityDescriptorDacl AddAce SetSecurityDescriptorOwner RegOpenKeyExW GetSecurityDescriptorControl SetSecurityDescriptorControl GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorSacl RegCloseKey GetSecurityDescriptorOwner

ntdll

NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile NtOpenFile

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

vcruntime140

strrchr memcmp memcpy memset _CxxThrowException strchr __C_specific_handler memchr __current_exception __current_exception_context __CxxFrameHandler3 memmove

api-ms-win-crt-string-l1-1-0

towlower strncmp strcmp strspn strcspn iswctype strlen isdigit

api-ms-win-crt-math-l1-1-0

ceilf pow log _fdopen fmod __setusermatherr log10f

api-ms-win-crt-heap-l1-1-0

_msize calloc free realloc _set_new_mode malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc exit _get_initial_narrow_environment _initterm_e _beginthreadex _endthreadex _wassert abort _seh_filter_exe _set_app_type _initialize_onexit_table _register_onexit_function _configure_narrow_argv _crt_atexit terminate _initialize_narrow_environment _exit _initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fputs fputc fclose __acrt_iob_func __stdio_common_vsprintf _set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_c46075751f483c5ddaf0b692e021f596_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

advapi32

ntdll

bcryptprimitives

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic