2026-07-19_8abc45e336baba6f016a2a0e42a8ba43_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_8abc45e336baba6f016a2a0e42a8ba43_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 11.2MB
Sample260720-bd69vsay6n
SHA256 943daead0145a27db6625779141a02dd04be036eaff19cb4ac8be7a20ea108ef
MD5 8abc45e336baba6f016a2a0e42a8ba43
SHA1 db49f15c6d9b35efe204a4af86b014429ca8ee21
SHA512 baaee840dfc3158cc6c51352cb2013ddcdc08eca851e0c3736a0524608e57e7bfa452d139f58584795edf7d4cdfa1f78d9727cedda26beb767fdef8b911b6f8b
SSDEEP 98304:aOh9mfxhEGL1XLsVYkiMiDvOkbpK+ATduV2Mon9KM:Ifxhb1XwKOkbQ
TLSH
T175C61821BB5AA9ADC19AC874834646725E3130DB0B35B9FF44C492793F69AF41F3C368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_8abc45e336baba6f016a2a0e42a8ba43_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-19_8abc45e336baba6f016a2a0e42a8ba43_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 11.2MB

2026-07-19_8abc45e336baba6f016a2a0e42a8ba43_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH fa19935fd9ef88af97cd3e1cd49b0af0
SHA256 943daead0145a27db6625779141a02dd04be036eaff19cb4ac8be7a20ea108ef
MD5 8abc45e336baba6f016a2a0e42a8ba43
SHA1 db49f15c6d9b35efe204a4af86b014429ca8ee21
SHA512 baaee840dfc3158cc6c51352cb2013ddcdc08eca851e0c3736a0524608e57e7bfa452d139f58584795edf7d4cdfa1f78d9727cedda26beb767fdef8b911b6f8b
SSDEEP 98304:aOh9mfxhEGL1XLsVYkiMiDvOkbpK+ATduV2Mon9KM:Ifxhb1XwKOkbQ
TLSH
T175C61821BB5AA9ADC19AC874834646725E3130DB0B35B9FF44C492793F69AF41F3C368
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8128048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nff.pdb

bcryptprimitives

ProcessPrng

kernel32

CloseHandle GetLastError SetHandleInformation WaitForSingleObject GetCurrentProcess DuplicateHandle CreateFileW ReadFile FlushFileBuffers WriteFile GlobalFree CreateIoCompletionPort SetFileCompletionNotificationModes GetOverlappedResult InitializeSListHead CancelIoEx GetQueuedCompletionStatusEx DeleteFileW GetStdHandle GetConsoleScreenBufferInfo GetConsoleMode GetFileInformationByHandleEx SetConsoleMode SetConsoleTextAttribute ExitProcess GetTempPathW PostQueuedCompletionStatus SetLastError LocalFree GetBinaryTypeW SwitchToThread CreateDirectoryW lstrlenW GetCommState SetCommState EscapeCommFunction SetCommTimeouts ClearCommBreak ClearCommError GetCommModemStatus PurgeComm SetCommBreak GetFileAttributesW SetFileAttributesW GetCurrentThreadId GetCurrentProcessId SetNamedPipeHandleState FormatMessageW GlobalAlloc GetSystemInfo GetCommandLineW GetSystemDirectoryW GetCurrentDirectoryW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemTimeAsFileTime QueryPerformanceCounter SetFilePointerEx QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetModuleFileNameW FindNextFileW SetUnhandledExceptionFilter RtlVirtualUnwind FindClose CompareStringOrdinal WriteFileEx SleepEx GetFullPathNameW MoveFileExW SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc CreateThread CreateEventW SetThreadStackGuarantee ReadFileEx RtlCaptureContext RtlLookupFunctionEntry CancelIo GetFileInformationByHandle GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetProcessId TerminateProcess AddVectoredExceptionHandler GetCurrentThread GetEnvironmentVariableW CopyFileExW FindFirstFileExW CreateHardLinkW GetProcAddress WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW SetEnvironmentVariableW HeapAlloc ReadConsoleW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileType GetModuleHandleW Sleep WaitForMultipleObjects GetModuleHandleA

ws2_32

getsockopt accept WSASend ioctlsocket getpeername select getaddrinfo send WSAGetLastError socket WSACleanup getsockname freeaddrinfo WSAStartup WSAIoctl setsockopt shutdown connect listen bind WSASocketW closesocket recv

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

advapi32

RegEnumValueW SystemFunction036 RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey RegQueryInfoKeyW

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateNamedPipeFile NtCreateFile NtWriteFile NtOpenFile NtReadFile

setupapi

SetupDiClassGuidsFromNameW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiOpenDevRegKey

cfgmgr32

CM_Get_Parent CM_Get_Device_IDW CM_Get_DevNode_Status

bcrypt

BCryptGenRandom

vcruntime140

memmove __current_exception_context __current_exception __C_specific_handler _CxxThrowException memset memcmp memcpy __CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

malloc free calloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e exit _exit _initialize_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argc _wassert _set_app_type

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_8abc45e336baba6f016a2a0e42a8ba43_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

shell32

combase

advapi32

ntdll

setupapi

cfgmgr32

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic