1cb23d0ef4b4ff784d71647a6f763adf2929703d279be0ef10bdcb24d74b0b6b

General

Target
2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Size 3.5MB
Sample260720-c8a1kscz4n
SHA256 1cb23d0ef4b4ff784d71647a6f763adf2929703d279be0ef10bdcb24d74b0b6b
MD5 a4c4f3a11c4330ee789bc68ddd4abd74
SHA1 a6616d328ad057da36e7967e86e4a0a9e51c131f
SHA512 f9d3075393bc814df62d0ef808dac120dd2463eacc006e02819746d0ec4d68719496523d2399b327d7e623ab7e0c1b8aa858d73ada2aef7e7669dbeb6fe628a0
SSDEEP 49152:cIlrrzvqPoarxR3Za0M+oH3Wr7DeefXwuyoASY+u0KL6DGcGlG0H+Ui8eqOm:HrnmbrBoy3tw+3uk8hf
TLSH
T11CF58C03FBA581E9C0AEC178C71B5223EB72B88D5720B69B67D44A213F67B605F9D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1980	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3172	PING.EXE
1980	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4408	netsh.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4152	reg.exe
3552	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3172	PING.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4152	5024	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	89
PID 5024 wrote to memory of 3552	5024	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	91
PID 5024 wrote to memory of 4408	5024	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	93
PID 5024 wrote to memory of 1980	5024	2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	95
PID 1980 wrote to memory of 3172	1980	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s /v DisplayName
  2⤵
  - Modifies registry key
  PID:4152
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /v DisplayName
  2⤵
  - Modifies registry key
  PID:3552
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:4408
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C "ping 127.0.0.1 -n 3 > nul & del /F /Q \"C:\Users\Admin\AppData\Local\Temp\2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe\""
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3172