General
- Target 2026-07-29_7b47ea26d8ffc99ba24e43c39de22a72_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 3.9MB
- Sample260730-b9rjaaxbmb
- SHA256 8b824d05dc070755cf26da7c12bd50823c3337fc77472f138287ad6ae2678c1a
- MD5 7b47ea26d8ffc99ba24e43c39de22a72
- SHA1 ae3dcc9446c270edfc6756c14b5e41f74564c6ba
- SHA512 21092ad4985494c9921e8dac2705e072b36be5fd3da0ddae41ab4a50286ec21dec6726f8dfc877d9dc5a00f89e66363f1881d5650cc4d93cd248912afd26dc42
- SSDEEP 49152:cCiHnZyAWOXaanibVx/l769Y2qzak7TarN6vgajmGPKA5n0N/cRi6eU/:cbngb2kE/cec
- TLSH T178162922BF6A98ADC89AC0B483668762597134CB0F35B8FF448455387F6DAF11E3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_7b47ea26d8ffc99ba24e43c39de22a72_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_7b47ea26d8ffc99ba24e43c39de22a72_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_7b47ea26d8ffc99ba24e43c39de22a72_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 3.9MB
- SHA256 8b824d05dc070755cf26da7c12bd50823c3337fc77472f138287ad6ae2678c1a
- MD5 7b47ea26d8ffc99ba24e43c39de22a72
- SHA1 ae3dcc9446c270edfc6756c14b5e41f74564c6ba
- SHA512 21092ad4985494c9921e8dac2705e072b36be5fd3da0ddae41ab4a50286ec21dec6726f8dfc877d9dc5a00f89e66363f1881d5650cc4d93cd248912afd26dc42
- SSDEEP 49152:cCiHnZyAWOXaanibVx/l769Y2qzak7TarN6vgajmGPKA5n0N/cRi6eU/:cbngb2kE/cec
- TLSH T178162922BF6A98ADC89AC0B483668762597134CB0F35B8FF448455387F6DAF11E3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.