2026-07-20_ed22ede6bb05b280569ba05baeecad06_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_ed22ede6bb05b280569ba05baeecad06_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 9.2MB
Sample260720-kcdetsbv4q
SHA256 3300f51881014cc0cd2d7f11506838074401cb7836b92003c7c249c62ac2abf5
MD5 ed22ede6bb05b280569ba05baeecad06
SHA1 a4ea268e358725b49e6910244cf20bf8f387f052
SHA512 ebb7d36532bae80321cb72c15905d87116f1fb538fc36eed594ec7cec09dc4395e9ece706718c28118d29725fe516fe2647d554cbd100ef62dee50c35e7a9875
SSDEEP 98304:ruDj+mw1zkxOWwwrOlqxvXBIYFFZl2sz+PPtxm6EJOqGld+ZcP:ixOKf5d9OPtxm6EDGldwcP
TLSH
T1EBA65B43F6A681E8C16AC074835A6233FB72B84947357AEB57D08A353F62FD06A3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_ed22ede6bb05b280569ba05baeecad06_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-20_ed22ede6bb05b280569ba05baeecad06_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 9.2MB

2026-07-20_ed22ede6bb05b280569ba05baeecad06_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 145810bcfc639f28d4d6bec96fecac40
SHA256 3300f51881014cc0cd2d7f11506838074401cb7836b92003c7c249c62ac2abf5
MD5 ed22ede6bb05b280569ba05baeecad06
SHA1 a4ea268e358725b49e6910244cf20bf8f387f052
SHA512 ebb7d36532bae80321cb72c15905d87116f1fb538fc36eed594ec7cec09dc4395e9ece706718c28118d29725fe516fe2647d554cbd100ef62dee50c35e7a9875
SSDEEP 98304:ruDj+mw1zkxOWwwrOlqxvXBIYFFZl2sz+PPtxm6EJOqGld+ZcP:ixOKf5d9OPtxm6EDGldwcP
TLSH
T1EBA65B43F6A681E8C16AC074835A6233FB72B84947357AEB57D08A353F62FD06A3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7286944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vibe_coding_tracker.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

GetTimeZoneInformationForYear SystemTimeToFileTime GetStdHandle FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCursorInfo SetConsoleCursorPosition ReadConsoleInputW GetNumberOfConsoleInputEvents GetConsoleOutputCP CreateHardLinkW WriteConsoleW GetConsoleScreenBufferInfo ReadConsoleW GetModuleHandleA CreateConsoleScreenBuffer SetConsoleActiveScreenBuffer GetTickCount SetConsoleMode GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile GetNativeSystemInfo DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW AreFileApisANSI InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetProcAddress InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue GetSystemTime GetFileType CreateSymbolicLinkW CopyFileExW DeleteFileW GetTempPathW DuplicateHandle GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CancelIo CreateEventW ExitProcess CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle GetFullPathNameW SetHandleInformation QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency WriteFileEx SleepEx ReadFileEx HeapAlloc ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId SetFilePointerEx GetConsoleMode FindNextFileW CreateToolhelp32Snapshot CreateThread GetSystemInfo Sleep CancelIoEx WriteFile GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus SetWaitableTimer CreateWaitableTimerExW GetQueuedCompletionStatusEx GetComputerNameExW SwitchToThread InitializeSListHead SetUnhandledExceptionFilter SetFileTime CreateFileW WaitForMultipleObjects GetSystemTimePreciseAsFileTime GetCurrentThread SetThreadStackGuarantee FlushFileBuffers Process32FirstW Process32NextW GetProcessTimes AddVectoredExceptionHandler HeapReAlloc GetExitCodeProcess GetSystemTimes MoveFileExW WaitForSingleObject GetLastError CloseHandle SetFileAttributesW GetProcessIoCounters ReadProcessMemory VirtualQueryEx OpenProcess HeapFree GetProcessHeap LocalFree SetConsoleTextAttribute LeaveCriticalSection EnterCriticalSection TryEnterCriticalSection DeleteCriticalSection RaiseException WideCharToMultiByte GetCurrentDirectoryW LoadLibraryA lstrlenW MultiByteToWideChar GetEnvironmentVariableW GetModuleHandleW CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetCommandLineW MapViewOfFile CreateFileMappingW FormatMessageA HeapDestroy HeapCompact LoadLibraryW FlushViewOfFile OutputDebugStringW HeapSize HeapCreate InitializeCriticalSection OutputDebugStringA UnmapViewOfFile HeapValidate

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

ws2_32

WSASend freeaddrinfo getaddrinfo WSACleanup WSAStartup send connect bind WSAIoctl ioctlsocket WSASocketW setsockopt closesocket recv getsockname WSAGetLastError getpeername shutdown getsockopt

ntdll

NtReadFile NtWriteFile NtCreateFile NtCancelIoFileEx NtOpenFile RtlNtStatusToDosError NtQueryInformationProcess NtCreateNamedPipeFile RtlGetVersion NtDeviceIoControlFile

pdh

PdhCollectQueryData PdhOpenQueryA PdhEnumObjectsA PdhCloseQuery PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue

psapi

GetModuleFileNameExW GetProcessMemoryInfo

advapi32

IsValidSid CopySid GetLengthSid GetTokenInformation OpenProcessToken

oleaut32

GetErrorInfo

powrprof

CallNtPowerInformation

bcryptprimitives

ProcessPrng

crypt32

CertFreeCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChain CertSetCertificateContextProperty CertOpenStore CertFreeCertificateChainEngine CertCloseStore CertCreateCertificateChainEngine CertAddEncodedCertificateToStore

user32

ToUnicodeEx GetKeyboardLayout GetForegroundWindow GetWindowThreadProcessId

vcruntime140

memcmp __CxxFrameHandler3 memmove memset __current_exception __current_exception_context memchr strchr strrchr memcpy __C_specific_handler

api-ms-win-crt-math-l1-1-0

pow fmod round floorf floor ceil __setusermatherr ceilf log trunc

api-ms-win-crt-string-l1-1-0

wcslen strlen strspn strncmp strcmp strcspn

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc malloc free

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table terminate _seh_filter_exe _set_app_type abort _endthreadex _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _beginthreadex _crt_atexit _wassert _errno _register_thread_local_exe_atexit_callback _initterm_e _c_exit exit _exit _cexit __p___argc __p___argv

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fflush __acrt_iob_func fgets ferror feof fclose _fileno fread fseek ftell __p__commode fwrite _setmode fopen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_ed22ede6bb05b280569ba05baeecad06_akira_cobalt-strike_glassworm_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

shell32

ole32

ws2_32

ntdll

pdh

psapi

advapi32

oleaut32

powrprof

bcryptprimitives

crypt32

user32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic