2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 3.5MB
Sample260720-c8a1kscz4n
SHA256 1cb23d0ef4b4ff784d71647a6f763adf2929703d279be0ef10bdcb24d74b0b6b
MD5 a4c4f3a11c4330ee789bc68ddd4abd74
SHA1 a6616d328ad057da36e7967e86e4a0a9e51c131f
SHA512 f9d3075393bc814df62d0ef808dac120dd2463eacc006e02819746d0ec4d68719496523d2399b327d7e623ab7e0c1b8aa858d73ada2aef7e7669dbeb6fe628a0
SSDEEP 49152:cIlrrzvqPoarxR3Za0M+oH3Wr7DeefXwuyoASY+u0KL6DGcGlG0H+Ui8eqOm:HrnmbrBoy3tw+3uk8hf
TLSH
T11CF58C03FBA581E9C0AEC178C71B5223EB72B88D5720B69B67D44A213F67B605F9D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 3.5MB

2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH 0bf5bfe12f948ab80a43135031041fcf
SHA256 1cb23d0ef4b4ff784d71647a6f763adf2929703d279be0ef10bdcb24d74b0b6b
MD5 a4c4f3a11c4330ee789bc68ddd4abd74
SHA1 a6616d328ad057da36e7967e86e4a0a9e51c131f
SHA512 f9d3075393bc814df62d0ef808dac120dd2463eacc006e02819746d0ec4d68719496523d2399b327d7e623ab7e0c1b8aa858d73ada2aef7e7669dbeb6fe628a0
SSDEEP 49152:cIlrrzvqPoarxR3Za0M+oH3Wr7DeefXwuyoASY+u0KL6DGcGlG0H+Ui8eqOm:HrnmbrBoy3tw+3uk8hf
TLSH
T11CF58C03FBA581E9C0AEC178C71B5223EB72B88D5720B69B67D44A213F67B605F9D344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2349344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

xeno_grabber.pdb

kernel32

WriteFile PostQueuedCompletionStatus ReadFile GetACP IsValidCodePage SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes CancelIoEx GetOEMCP GetCPInfo SetEnvironmentVariableW LCMapStringW CompareStringW SwitchToThread HeapReAlloc GetCurrentThread GetTimeZoneInformation UnhandledExceptionFilter GetCommandLineW GetCommandLineA RtlPcToFileHeader InitializeCriticalSectionEx EncodePointer RtlUnwindEx SetUnhandledExceptionFilter CreateFileW SetThreadStackGuarantee GlobalMemoryStatusEx GetFileInformationByHandle FindClose CopyFileExW SetFileInformationByHandle DeleteFileW GetModuleHandleW GetProcAddress InitializeSListHead SetFilePointerEx GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA GetCurrentProcess CreateMutexA ReleaseMutex GetSystemTimePreciseAsFileTime GetConsoleMode GetConsoleOutputCP WriteConsoleW GetExitCodeProcess GetFullPathNameW FindFirstFileExW SetFileTime GetFileInformationByHandleEx GetFileType GetModuleHandleA GetModuleFileNameW GetTempPathW SetStdHandle LoadLibraryExW SetHandleInformation WaitForSingleObject CreateThread WriteFileEx SleepEx ReadFileEx GetSystemInfo ExitProcess CreateEventW CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle VirtualProtect IsProcessorFeaturePresent FindNextFileW TerminateProcess FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI GetOverlappedResult WaitForMultipleObjects GetModuleHandleExW FreeLibraryAndExitThread LocalFree GlobalUnlock GlobalLock GetCurrentProcessId ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc FormatMessageW GetLastError GetStringTypeW HeapAlloc HeapFree GetProcessHeap GetStdHandle GetStartupInfoW IsDebuggerPresent CloseHandle AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal FormatMessageA SystemTimeToFileTime OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA

crypt32

CertGetCertificateChain CertDuplicateCertificateContext CertFreeCertificateChain CertDuplicateStore CryptUnprotectData CertFreeCertificateContext CertVerifyCertificateChainPolicy CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ws2_32

shutdown closesocket WSASend WSASocketW recv ioctlsocket getsockopt setsockopt bind WSAStartup WSAIoctl WSACleanup getaddrinfo freeaddrinfo send getsockname WSAGetLastError getpeername connect

ntdll

NtReadFile NtCreateFile NtWriteFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtOpenFile NtCreateNamedPipeFile

secur32

DecryptMessage ApplyControlToken InitializeSecurityContextW AcceptSecurityContext AcquireCredentialsHandleA QueryContextAttributesW DeleteSecurityContext FreeContextBuffer EncryptMessage FreeCredentialsHandle

bcryptprimitives

ProcessPrng

user32

GetSystemMetrics ReleaseDC MessageBoxA GetClipboardData OpenClipboard CloseClipboard GetDC

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits DeleteObject DeleteDC

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_a4c4f3a11c4330ee789bc68ddd4abd74_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

kernel32

advapi32

crypt32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

secur32

bcryptprimitives

user32

gdi32

generic