2026-07-23_f6aa19de1ce275a73967d73e89423e7c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_f6aa19de1ce275a73967d73e89423e7c_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 8.6MB
Sample260724-bdvwtsel7t
SHA256 659274b4796a715b863b879aca51c1784cf8745e25a7f4efb906241d42350b0c
MD5 f6aa19de1ce275a73967d73e89423e7c
SHA1 8ca16f03b0c525ff83eb6d202b9b5284ddf139e1
SHA512 2f4db7cdb262d9c1f1487ec032590bf26079b0e63152594dd85294ede8f62067fe323005fb1af3ffd64ef70afa0260348045f9738b0323bb48bd5d5108b500d0
SSDEEP 98304:dKDZZRcyI7uvP65Pz9JeIWyuoAjhB5+3og5HXZn7Ws9LjR0mI/RCn+IOO0NZi:oNcyElHd2R4l4i
TLSH
T1EE963A027B9F59A9D199C874C34B8BB38B2230CB1A36B5BF45D601253F7DAB11E2D319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-23_f6aa19de1ce275a73967d73e89423e7c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-23_f6aa19de1ce275a73967d73e89423e7c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 8.6MB

2026-07-23_f6aa19de1ce275a73967d73e89423e7c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d817893d9f6bdbdb028f58550c5ac040
SHA256 659274b4796a715b863b879aca51c1784cf8745e25a7f4efb906241d42350b0c
MD5 f6aa19de1ce275a73967d73e89423e7c
SHA1 8ca16f03b0c525ff83eb6d202b9b5284ddf139e1
SHA512 2f4db7cdb262d9c1f1487ec032590bf26079b0e63152594dd85294ede8f62067fe323005fb1af3ffd64ef70afa0260348045f9738b0323bb48bd5d5108b500d0
SSDEEP 98304:dKDZZRcyI7uvP65Pz9JeIWyuoAjhB5+3og5HXZn7Ws9LjR0mI/RCn+IOO0NZi:oNcyElHd2R4l4i
TLSH
T1EE963A027B9F59A9D199C874C34B8BB38B2230CB1A36B5BF45D601253F7DAB11E2D319
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

71:e3:b0:c2:af:53:dd:37:2b:09:52:96:2e:47:b0:9b:a2:01:85:db:86:72:cc:a1:c5:2e:6b:af:91:a1:81:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NVIDIA Corporation

Chains

Jul 23, 2026

CN=NVIDIA Corporation

Subject

CN=NVIDIA Corporation

Serial Number

13:33:6d:65:a2:7e:19:b7:45:53:2d:97:d2:5a:6d:f5

Issuer

CN=RootCA

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 22, 2026 - Jun 22, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6739920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

discord_c2.pdb

crypt32

CryptUnprotectData

kernel32

FindNextFileW FindClose GetLastError GetProcessHeap HeapFree GetSystemInfo SetCurrentDirectoryW SetLastError GetCurrentProcessId CopyFileExW LocalFree FindFirstFileExW CloseHandle GetComputerNameExW GetSystemTimePreciseAsFileTime AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc SwitchToThread GetOverlappedResult WriteFile PostQueuedCompletionStatus ReadFile GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes CancelIoEx Sleep GetModuleHandleA GetProcAddress CreateFileW SetNamedPipeHandleState GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW GetFullPathNameW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetModuleHandleW FormatMessageW GetModuleFileNameW GetTempPathW SetHandleInformation DeleteFileW QueryPerformanceFrequency CreateThread WriteFileEx SleepEx ReadFileEx QueryPerformanceCounter ExitProcess CreateEventW CancelIo CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetProcessTimes GetSystemTimes GetProcessIoCounters ReadProcessMemory VirtualQueryEx OpenProcess GlobalMemoryStatusEx K32GetPerformanceInfo LoadLibraryExA FreeLibrary SetUnhandledExceptionFilter InitializeSListHead UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW UnlockFile AreFileApisANSI HeapSize InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection LockFileEx HeapValidate GetFileSize GetTickCount FlushFileBuffers FormatMessageA GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA DeleteFileA SystemTimeToFileTime LoadLibraryW HeapCompact RaiseException HeapDestroy GetSystemTime CreateFileMappingW GetSystemTimeAsFileTime HeapCreate MapViewOfFile

ws2_32

recv WSACleanup WSAStartup send getaddrinfo freeaddrinfo bind setsockopt connect ioctlsocket WSASocketW WSAIoctl shutdown closesocket WSASend getsockopt WSAGetLastError getpeername getsockname

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtReadFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation RtlGetVersion

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

advapi32

SystemFunction036 RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken CopySid GetLengthSid IsValidSid GetTokenInformation

oleaut32

GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

user32

EnumDisplayMonitors GetMonitorInfoW EnumDisplaySettingsExW

gdi32

GetDeviceCaps DeleteDC CreateCompatibleDC CreateCompatibleBitmap SelectObject SetStretchBltMode StretchBlt GetDIBits GetObjectW DeleteObject CreateDCW

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

pdh

PdhAddEnglishCounterW PdhCollectQueryData PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue PdhOpenQueryA

powrprof

CallNtPowerInformation

vcruntime140

__current_exception __C_specific_handler __CxxFrameHandler3 memset memcpy strrchr __current_exception_context memcmp memmove strchr _CxxThrowException memchr

api-ms-win-crt-string-l1-1-0

strcmp strcspn strncmp strspn wcslen strlen

api-ms-win-crt-math-l1-1-0

pow _dclass __setusermatherr log fabs

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc free malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _configure_narrow_argv terminate _initialize_narrow_environment _get_initial_narrow_environment _initterm __p___argv _register_onexit_function _register_thread_local_exe_atexit_callback _exit _cexit _initialize_onexit_table _initterm_e _c_exit _set_app_type _seh_filter_exe _endthreadex _beginthreadex exit __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_f6aa19de1ce275a73967d73e89423e7c_akira_cobalt-strike_glassworm_rusty-stealer_satacom

PE Signature issue

crypt32

kernel32

ws2_32

ntdll

api-ms-win-core-synch-l1-2-0

advapi32

oleaut32

bcryptprimitives

user32

gdi32

bcrypt

psapi

shell32

pdh

powrprof

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic