2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.8MB
Sample260731-pgntksac83
SHA256 64cbae4e3f67815e43549bfad67dc8c4954b3033fddaa1e70d7338eaf7b6f8e3
MD5 2200e318f3862b441862648c8e83a02f
SHA1 e2b9920692829e8b75e37d42c8e17269e5a858e9
SHA512 f1e797570c4344ea6545caf1cd103733362cbe9c95625dfa8e6ad37d9b143542413114f98808ee29a2e0178955e574c53dfb7062a8c12e992a19e622952f5580
SSDEEP 49152:BuiYpEs8ts9rLldOIJOVb9YBwwLxosRqKReZq+3n9b++jeRhyxRlDMojqSvTXQBd:BP5GdhMbGCq+X9+6XxMpt
TLSH
T174069D03FE9591E8D09EC179C71B9223EBB2B8891620B29F57D44B223F67B605F5D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.8MB

2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 918c17fbaac91ddec584adff535ee432
SHA256 64cbae4e3f67815e43549bfad67dc8c4954b3033fddaa1e70d7338eaf7b6f8e3
MD5 2200e318f3862b441862648c8e83a02f
SHA1 e2b9920692829e8b75e37d42c8e17269e5a858e9
SHA512 f1e797570c4344ea6545caf1cd103733362cbe9c95625dfa8e6ad37d9b143542413114f98808ee29a2e0178955e574c53dfb7062a8c12e992a19e622952f5580
SSDEEP 49152:BuiYpEs8ts9rLldOIJOVb9YBwwLxosRqKReZq+3n9b++jeRhyxRlDMojqSvTXQBd:BP5GdhMbGCq+X9+6XxMpt
TLSH
T174069D03FE9591E8D09EC179C71B9223EBB2B8891620B29F57D44B223F67B605F5D348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2754972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

private_rust.pdb

user32

OpenClipboard GetClipboardData CloseClipboard ShowWindow MessageBoxW GetSystemMetrics

bcryptprimitives

ProcessPrng

kernel32

CreateMutexA ReleaseMutex InitializeSListHead GetCurrentProcessId ReadFileEx SleepEx WriteFileEx CloseHandle SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW SetFileTime FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime CreateEventW CancelIo GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetProcessHeap WaitForMultipleObjects GetExitCodeProcess GetTempPathW HeapFree HeapAlloc SetFilePointerEx GetLastError LoadLibraryA FormatMessageW FindClose WaitForSingleObjectEx DeleteFileW GetCommandLineW GetConsoleWindow AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetFileInformationByHandle GetCurrentProcess GetCurrentThreadId GetSystemInfo GlobalMemoryStatusEx GetProcAddress GetModuleHandleW GetTickCount64 GlobalLock CreateFileW GlobalUnlock CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep LocalFree FindNextFileW SetThreadStackGuarantee GetCurrentThread HeapReAlloc SwitchToThread SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx CancelIoEx WriteFile PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort ReadFile GetOverlappedResult SetUnhandledExceptionFilter

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

getsockname closesocket WSAGetLastError connect ioctlsocket bind setsockopt WSASocketW getpeername WSASend WSAIoctl send shutdown freeaddrinfo getaddrinfo recv WSACleanup WSAStartup getsockopt

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtReadFile RtlNtStatusToDosError

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateChain CryptUnprotectData CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain

secur32

DeleteSecurityContext FreeCredentialsHandle EncryptMessage InitializeSecurityContextW FreeContextBuffer DecryptMessage ApplyControlToken AcceptSecurityContext AcquireCredentialsHandleA QueryContextAttributesW

vcruntime140

memcmp memcpy memset __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memmove memchr strchr strrchr

api-ms-win-crt-string-l1-1-0

strspn strcspn strlen strcmp strncmp

api-ms-win-crt-math-l1-1-0

fabs _dclass log2 log __setusermatherr

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode realloc _msize calloc

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initterm_e _set_app_type _seh_filter_exe _register_onexit_function _beginthreadex exit _exit __p___argc _initterm terminate _crt_atexit __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _endthreadex _initialize_onexit_table _wassert

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_2200e318f3862b441862648c8e83a02f_akira_cobalt-strike_glassworm_rusty-stealer_satacom

user32

bcryptprimitives

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

crypt32

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic