2026-07-28_ad6663fc15a112ef2fc9aad8fe8cad18_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_ad6663fc15a112ef2fc9aad8fe8cad18_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 21.6MB
Sample260728-e53brsywcw
SHA256 b478024b07dfe36fb17ae4511caaadc4dc7423736f0bd38012673f2c45d1ffa1
MD5 ad6663fc15a112ef2fc9aad8fe8cad18
SHA1 66779c0e80275d9c1e2a086fa9bf5737e65e45c4
SHA512 deaa3d8e7e80768ae66d7f60fa4602532b393c5fefda82328bda41bb28184bd0b8a6a5acaf89f3138891ce7c72c9653c3440dcdf40017d52a03b3b567a9c6acb
SSDEEP 196608:YmzkHgfNtE4iDM0zyBxYzTx+6ZyuhuJ90cXI:5zjNtAM8yYz1+qu
TLSH
T1503718113A5BA8ACD59AC870834A86735E2130DB1B36B9FF44C896393F6DAF45B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_ad6663fc15a112ef2fc9aad8fe8cad18_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-28_ad6663fc15a112ef2fc9aad8fe8cad18_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 21.6MB

2026-07-28_ad6663fc15a112ef2fc9aad8fe8cad18_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH ef59474d7d0914ee05e2b17982896eb1
SHA256 b478024b07dfe36fb17ae4511caaadc4dc7423736f0bd38012673f2c45d1ffa1
MD5 ad6663fc15a112ef2fc9aad8fe8cad18
SHA1 66779c0e80275d9c1e2a086fa9bf5737e65e45c4
SHA512 deaa3d8e7e80768ae66d7f60fa4602532b393c5fefda82328bda41bb28184bd0b8a6a5acaf89f3138891ce7c72c9653c3440dcdf40017d52a03b3b567a9c6acb
SSDEEP 196608:YmzkHgfNtE4iDM0zyBxYzTx+6ZyuhuJ90cXI:5zjNtAM8yYz1+qu
TLSH
T1503718113A5BA8ACD59AC870834A86735E2130DB1B36B9FF44C896393F6DAF45B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15961888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

osr.pdb

kernel32

WaitForSingleObject ReadFileEx SleepEx WriteFileEx GetCurrentProcessId ReleaseSemaphore GetCurrentThreadId QueryPerformanceFrequency QueryPerformanceCounter ReadDirectoryChangesW InitializeSListHead AreFileApisANSI CreateFileW GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile ReadFile CreateEventW GetOverlappedResult GetTempPathA GetDiskFreeSpaceA GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesA TerminateProcess GetExitCodeProcess GetCurrentProcess WaitForMultipleObjects CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW WideCharToMultiByte LoadLibraryA CreateMutexA ReleaseMutex CancelIo SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar CreateWaitableTimerExW SetWaitableTimer WaitForSingleObjectEx FormatMessageW GetFileAttributesExW DeleteFileA UnlockFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind LocalFree GetFileSize FreeLibrary GetSystemTimeAsFileTime MapViewOfFile CreateFileMappingW FormatMessageA SystemTimeToFileTime LockFileEx HeapDestroy HeapCompact LoadLibraryW CreateFileA FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx OutputDebugStringA WriteFile HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CreateSemaphoreW GetSystemTime GetTickCount FindNextFileW GetTempPathW GetFileAttributesW GetConsoleOutputCP GetConsoleMode WriteConsoleW ReadConsoleW DeleteFileW GetFinalPathNameByHandleW FindFirstFileExW MoveFileExW SetFileAttributesW DuplicateHandle CreateThread GetStdHandle GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SwitchToThread HeapReAlloc HeapFree GetProcessHeap Sleep GetModuleHandleA GetProcAddress SetFileTime SetHandleInformation GetFullPathNameW SetLastError CompareStringOrdinal GetModuleHandleW SetUnhandledExceptionFilter GetSystemInfo SetFileInformationByHandle GetSystemTimePreciseAsFileTime FlushFileBuffers FindClose CloseHandle CreateProcessW GetLastError

ntdll

RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ws2_32

WSAStartup freeaddrinfo WSASend getsockname WSADuplicateSocketW WSASocketW send connect getsockopt recv ioctlsocket closesocket setsockopt WSAGetLastError getaddrinfo getpeername WSACleanup WSARecv select

vcruntime140

__current_exception memmove memcpy __CxxFrameHandler3 __C_specific_handler memcmp memset _CxxThrowException strchr strrchr memchr __current_exception_context

api-ms-win-crt-string-l1-1-0

strcspn strspn strcmp strncmp strlen

api-ms-win-crt-math-l1-1-0

sqrt log __setusermatherr fmod

api-ms-win-crt-heap-l1-1-0

free malloc _msize realloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit _set_app_type _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argc _seh_filter_exe _endthreadex _configure_narrow_argv _initialize_narrow_environment _beginthreadex _get_initial_narrow_environment _initterm exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_ad6663fc15a112ef2fc9aad8fe8cad18_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

ntdll

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic