64cbae4e3f67815e43549bfad67dc8c4954b3033fddaa1e70d7338eaf7b6f8e3

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:18

Target
2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 3.8MB
Sample260731-pgntksac83
SHA256 64cbae4e3f67815e43549bfad67dc8c4954b3033fddaa1e70d7338eaf7b6f8e3
MD5 2200e318f3862b441862648c8e83a02f
SHA1 e2b9920692829e8b75e37d42c8e17269e5a858e9
SHA512 f1e797570c4344ea6545caf1cd103733362cbe9c95625dfa8e6ad37d9b143542413114f98808ee29a2e0178955e574c53dfb7062a8c12e992a19e622952f5580
SSDEEP 49152:BuiYpEs8ts9rLldOIJOVb9YBwwLxosRqKReZq+3n9b++jeRhyxRlDMojqSvTXQBd:BP5GdhMbGCq+X9+6XxMpt
TLSH
T174069D03FE9591E8D09EC179C71B9223EBB2B8891620B29F57D44B223F67B605F5D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
1	discord.com
5	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

pid	Process
2484	netsh.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5480 wrote to memory of 2484	5480	2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\system32\netsh.exe
  "netsh" wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2484