2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 6.3MB
Sample260730-fp73razemb
SHA256 c1d19e2f21c2627adce2bbf535b3e705d923cf82b8886bdb0dcefbb9cfa2692d
MD5 b1a33ed1dd38ca9a958c7f2e00d574be
SHA1 e8ade8fb14e0053ae0c9b1cd3d08f673a8026dfe
SHA512 8534107543882e4b3c98efdf5b2918e7a338d82702892e74ab7917729484349caa6b67e517c7b7bae79c23ba1c58d7d54e90b4d312c8f7d6bd2a3b1962f066e7
SSDEEP 98304:KPTbvjzNVz4HtM2S2Kc1h7Ap/rwDRi9Q1RtMM8Yxdn+AV:yzbqS2QevV
TLSH
T13D667C03F69181E9C09EC078835BA637EB72BCC94935B6DB1BE44B112E26F906F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

File Explorer

2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 6.3MB

2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 6ae72e33caf86f4b69ed186b9ec6aace
SHA256 c1d19e2f21c2627adce2bbf535b3e705d923cf82b8886bdb0dcefbb9cfa2692d
MD5 b1a33ed1dd38ca9a958c7f2e00d574be
SHA1 e8ade8fb14e0053ae0c9b1cd3d08f673a8026dfe
SHA512 8534107543882e4b3c98efdf5b2918e7a338d82702892e74ab7917729484349caa6b67e517c7b7bae79c23ba1c58d7d54e90b4d312c8f7d6bd2a3b1962f066e7
SSDEEP 98304:KPTbvjzNVz4HtM2S2Kc1h7Ap/rwDRi9Q1RtMM8Yxdn+AV:yzbqS2QevV
TLSH
T13D667C03F69181E9C09EC078835BA637EB72BCC94935B6DB1BE44B112E26F906F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist

Digest

ae:f0:ee:5c:a8:c3:5b:54:f5:84:09:8c:48:a7:8a:68:e9:76:21:32:42:41:67:b5:ef:b7:d3:ff:d2:72:59:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Jul 20, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

36:6f:90:eb:04:b7:bc:e6:af:cb:98:c0

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 12, 2026 - Sep 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4135264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Wuwa_Mod_Fixer.pdb

ntdll

NtWriteFile NtCreateFile NtCancelIoFileEx RtlGetVersion NtReadFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtDeviceIoControlFile

user32

DispatchMessageW PostThreadMessageW PeekMessageW MsgWaitForMultipleObjectsEx GetRawInputData ValidateRect LoadCursorW SetCursor IsIconic GetAsyncKeyState GetUpdateRect MapVirtualKeyW RegisterTouchWindow SetCursorPos UpdateWindow InvalidateRect IsWindowEnabled SetWindowTextW IsWindowVisible GetWindowTextW SystemParametersInfoW GetWindowLongPtrW TrackMouseEvent TranslateMessage ScreenToClient GetTouchInputInfo GetWindowTextLengthW EnableWindow SetParent GetMessageW MonitorFromRect SetCapture CloseTouchInputHandle EnumDisplayMonitors MonitorFromPoint ShowCursor ClipCursor FindWindowExW GetClipCursor DefWindowProcW RegisterRawInputDevices SetWindowDisplayAffinity ReleaseCapture GetKeyState MapVirtualKeyExW GetKeyboardState SetWindowRgn GetParent GetWindowPlacement GetMonitorInfoW SetWindowPlacement ChangeDisplaySettingsExW AdjustWindowRectEx GetMenu GetWindowLongW SetWindowLongW IsWindow InvalidateRgn RegisterWindowMessageA RedrawWindow AdjustWindowRect SetPropW FlashWindowEx GetWindow IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu SetFocus GetSystemMetrics ToUnicodeEx GetKeyboardLayout GetWindowThreadProcessId GetForegroundWindow DestroyWindow PostMessageW SetWindowLongPtrW EnumChildWindows DispatchMessageA GetMessageA SetWindowPos CreateWindowExW RegisterClassExW GetSystemMenu MessageBoxW GetMenuItemInfoW TranslateAcceleratorW

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

kernel32

GetUserDefaultUILanguage SwitchToThread WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetExitCodeProcess WaitForSingleObject WaitForMultipleObjects GetProcessId RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue LCIDToLocaleName SetThreadStackGuarantee GetModuleHandleW FlsSetValue GetProcAddress LoadLibraryA FlsFree EncodePointer GetCurrentThreadId SetFileInformationByHandle MoveFileExW FreeLibrary GetCurrentThread LoadLibraryW GetSystemInfo GetProcessHeap SetLastError Sleep GetModuleHandleA FindClose CloseHandle InitializeSListHead GetFileInformationByHandle RtlUnwindEx RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId ReleaseMutex MultiByteToWideChar HeapAlloc SleepEx FormatMessageW SetHandleInformation GetFullPathNameW SetFileTime FindFirstFileExW GetFileInformationByHandleEx HeapFree ExitProcess GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW CopyFileExW SetWaitableTimer FindNextFileW GetUserPreferredUILanguages GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW ReadConsoleW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW GetConsoleOutputCP GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext GetLastError CompareStringOrdinal SetConsoleTextAttribute SetConsoleMode GetConsoleScreenBufferInfo ReadConsoleInputW GetNumberOfConsoleInputEvents FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCursorInfo SetConsoleCursorPosition AddVectoredExceptionHandler SetUnhandledExceptionFilter FreeConsole SetStdHandle AllocConsole GetConsoleMode HeapReAlloc GetStdHandle SetEnvironmentVariableW CreateWaitableTimerExW lstrlenW LoadLibraryExW CreateProcessW CancelIo CreateEventW CreateDirectoryW OutputDebugStringW OutputDebugStringA CreateThread SetFilePointerEx WriteFileEx ReadFileEx InitializeCriticalSectionEx CreateMutexA CreatePipe CancelIoEx WriteFile CreateIoCompletionPort ReadFile PostQueuedCompletionStatus TerminateProcess GetQueuedCompletionStatusEx GetFinalPathNameByHandleW GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear CreateMutexW SetFileCompletionNotificationModes CreateFileW DeviceIoControl GetOverlappedResult LoadLibraryExA DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ole32

CoInitialize RevokeDragDrop RegisterDragDrop CoUninitialize CoCreateInstance CoTaskMemFree CoInitializeEx OleInitialize CoTaskMemAlloc CoCreateFreeThreadedMarshaler

shell32

DragQueryFileW SHGetKnownFolderPath SHAppBarMessage ILFree DragFinish SHCreateItemFromParsingName ShellExecuteExW SHOpenFolderAndSelectItems ILCreateFromPathW ShellExecuteW

shlwapi

SHCreateMemStream

advapi32

EventSetInformation RegQueryValueExW RegCloseKey EventUnregister EventWriteTransfer RegOpenKeyExW RegGetValueW EventRegister SystemFunction036

gdi32

CreateCompatibleDC CreateRectRgn CombineRgn CreateDIBSection SetBkMode SelectObject BitBlt DeleteDC GetDeviceCaps SetTextColor CreateSolidBrush DeleteObject

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo

ws2_32

WSASend shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup bind setsockopt getsockopt connect ioctlsocket WSASocketW closesocket recv WSAIoctl getsockname WSAGetLastError getpeername

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func __p__commode freopen

api-ms-win-crt-math-l1-1-0

roundf round pow floor __setusermatherr trunc

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s wcscmp wcslen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _crt_atexit _initialize_onexit_table _initterm_e terminate _register_thread_local_exe_atexit_callback exit _c_exit _cexit _seh_filter_exe abort __p___argv __p___argc _exit _register_onexit_function

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free calloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_b1a33ed1dd38ca9a958c7f2e00d574be_akira_cobalt-strike_glassworm_rusty-stealer_satacom

ntdll

user32

comctl32

dwmapi

kernel32

api-ms-win-core-synch-l1-2-0

ole32

shell32

shlwapi

advapi32

gdi32

oleaut32

ws2_32

bcryptprimitives

bcrypt

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic