2026-07-30_de30f5663db1f19027ccbe2bae6c0ea4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_de30f5663db1f19027ccbe2bae6c0ea4_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.8MB
Sample260730-y5eegsfb34
SHA256 e5ef384ea97665acfd93ed3a344b5c8185aad8dcb545ec9499c19d60a7820995
MD5 de30f5663db1f19027ccbe2bae6c0ea4
SHA1 4e24494ce00ad54b840afaf9243f9fbfedd1b8f0
SHA512 efc78bf87cfeb218d16ffc4b42471b8451bb9a15506637a71619eb0350eacca5a15414443d1ef400ca8abdf40fece34e15f4f5036c7cf1c9c3079b5c1beb8dc4
SSDEEP 49152:IIQ1wvjapQ1a1ZAsmN2vBY2LCItM1mJfSc+wg5n9b++jevdNmC1Is1fL1vQ+eocM:I60BKN1McwgR9Mg+bnuUz
TLSH
T16A068D43FB9982F9C05EC178C7569223EB72B8891620B29F27D44B223F67B605F5D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_de30f5663db1f19027ccbe2bae6c0ea4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-30_de30f5663db1f19027ccbe2bae6c0ea4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.8MB

2026-07-30_de30f5663db1f19027ccbe2bae6c0ea4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 118562d54f349bd5878d43272d6493b2
SHA256 e5ef384ea97665acfd93ed3a344b5c8185aad8dcb545ec9499c19d60a7820995
MD5 de30f5663db1f19027ccbe2bae6c0ea4
SHA1 4e24494ce00ad54b840afaf9243f9fbfedd1b8f0
SHA512 efc78bf87cfeb218d16ffc4b42471b8451bb9a15506637a71619eb0350eacca5a15414443d1ef400ca8abdf40fece34e15f4f5036c7cf1c9c3079b5c1beb8dc4
SSDEEP 49152:IIQ1wvjapQ1a1ZAsmN2vBY2LCItM1mJfSc+wg5n9b++jevdNmC1Is1fL1vQ+eocM:I60BKN1McwgR9Mg+bnuUz
TLSH
T16A068D43FB9982F9C05EC178C7569223EB72B8891620B29F27D44B223F67B605F5D349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2734060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

private_rust.pdb

user32

OpenClipboard GetClipboardData CloseClipboard ShowWindow MessageBoxW GetSystemMetrics

bcryptprimitives

ProcessPrng

kernel32

ReleaseMutex InitializeSListHead CreateMutexA ReadFileEx SleepEx WriteFileEx CloseHandle SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW SetFileTime FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx GetProcessHeap GetSystemTimePreciseAsFileTime CreateEventW CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle HeapFree WaitForMultipleObjects GetExitCodeProcess GetTempPathW HeapAlloc GetLastError SetFilePointerEx FormatMessageW GetCurrentProcessId FindClose DeleteFileW WaitForSingleObjectEx SetFileInformationByHandle GetCommandLineW GetConsoleWindow AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetSystemInfo GetCurrentProcess GetCurrentThreadId GlobalMemoryStatusEx GetTickCount64 GetModuleHandleW GlobalLock GlobalUnlock CreateFileW CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep LoadLibraryA GetProcAddress LocalFree FindNextFileW SetThreadStackGuarantee GetCurrentThread HeapReAlloc SwitchToThread SetLastError GetFinalPathNameByHandleW CancelIoEx WriteFile GetQueuedCompletionStatusEx SetFileCompletionNotificationModes CreateIoCompletionPort PostQueuedCompletionStatus GetOverlappedResult ReadFile SetUnhandledExceptionFilter

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

getsockopt closesocket ioctlsocket connect bind setsockopt WSASocketW getsockname WSASend WSAIoctl send freeaddrinfo getpeername getaddrinfo shutdown WSAGetLastError WSACleanup WSAStartup recv

ntdll

NtOpenFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtReadFile NtWriteFile NtCreateNamedPipeFile NtCreateFile

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateStore CertEnumCertificatesInStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateContext CertOpenStore CertDuplicateCertificateContext CertFreeCertificateChain

secur32

DecryptMessage DeleteSecurityContext FreeCredentialsHandle FreeContextBuffer ApplyControlToken QueryContextAttributesW AcceptSecurityContext EncryptMessage AcquireCredentialsHandleA InitializeSecurityContextW

vcruntime140

memcmp memcpy memset __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memmove memchr strchr strrchr

api-ms-win-crt-string-l1-1-0

strspn strncmp strlen strcspn strcmp

api-ms-win-crt-math-l1-1-0

_dclass fabs log log2 __setusermatherr

api-ms-win-crt-heap-l1-1-0

calloc malloc _set_new_mode _msize realloc free

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _initterm _c_exit _initterm_e _register_onexit_function _beginthreadex exit _exit __p___argc __p___argv _get_initial_narrow_environment terminate _crt_atexit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit _endthreadex _set_app_type _wassert _initialize_onexit_table

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_de30f5663db1f19027ccbe2bae6c0ea4_akira_cobalt-strike_glassworm_rusty-stealer_satacom

user32

bcryptprimitives

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

crypt32

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic