2026-08-02_95b1ee2374632e3fe5629a3c8162f8fe_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_95b1ee2374632e3fe5629a3c8162f8fe_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 4.8MB
Sample260802-db2byasgma
SHA256 d42e70ca9b1a0f3a4905323d5e98ff035c8f4a2066a4c5dc01b473e4ace8a9c3
MD5 95b1ee2374632e3fe5629a3c8162f8fe
SHA1 d73b5cfb1f0369204e3902759340b180d25c9ddf
SHA512 f70bee37db36d003186c7483a50ff7f66c76cf883c160ffc03bbb2e38723db1d3ce9e13d2c9458ad5feeaf83059c587af4ff332b430dbec95189425349bd20e0
SSDEEP 49152:d5buTAw01OCKHMM9BMqXwpy7hs6mQm83mgakvGzJUp1c9+jAL8lrp24pa4oMXWk9:d5iKYJWae5Yeee6lyoYgb
TLSH
T1D4366C02BE9649D9C09AC870C7868A639F3274DF0A25FAFF51C505253F6ABB12F1D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_95b1ee2374632e3fe5629a3c8162f8fe_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-02_95b1ee2374632e3fe5629a3c8162f8fe_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 4.8MB

2026-08-02_95b1ee2374632e3fe5629a3c8162f8fe_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH a08d703c90c07c1dace3f82dffcd6a1b
SHA256 d42e70ca9b1a0f3a4905323d5e98ff035c8f4a2066a4c5dc01b473e4ace8a9c3
MD5 95b1ee2374632e3fe5629a3c8162f8fe
SHA1 d73b5cfb1f0369204e3902759340b180d25c9ddf
SHA512 f70bee37db36d003186c7483a50ff7f66c76cf883c160ffc03bbb2e38723db1d3ce9e13d2c9458ad5feeaf83059c587af4ff332b430dbec95189425349bd20e0
SSDEEP 49152:d5buTAw01OCKHMM9BMqXwpy7hs6mQm83mgakvGzJUp1c9+jAL8lrp24pa4oMXWk9:d5iKYJWae5Yeee6lyoYgb
TLSH
T1D4366C02BE9649D9C09AC870C7868A639F3274DF0A25FAFF51C505253F6ABB12F1D358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3232720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f4max_stealer.pdb

kernel32

CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx GetQueuedCompletionStatusEx CreateDirectoryW CreateEventW CancelIo GetOverlappedResult ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetFinalPathNameByHandleW DuplicateHandle SetFileCompletionNotificationModes WaitForMultipleObjects GetExitCodeProcess CreateIoCompletionPort DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep SwitchToThread SetFileAttributesW SetFilePointerEx FindNextFileW WriteFileEx GetTickCount64 SleepEx ReadFileEx FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI HeapAlloc WaitForSingleObject GlobalMemoryStatusEx ReleaseMutex SetHandleInformation CreateMutexA GetCurrentProcessId GetLogicalProcessorInformation LoadLibraryA WaitForSingleObjectEx GetSystemInfo GetTimeZoneInformationForYear SystemTimeToFileTime CreateToolhelp32Snapshot Process32First Process32Next GetCurrentThread SetThreadStackGuarantee GetCurrentThreadId GetProcAddress AddVectoredExceptionHandler GetModuleHandleW LocalFree SetCurrentDirectoryW PostQueuedCompletionStatus GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW OpenProcess FormatMessageA OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeSListHead GetLastError SetLastError GetCurrentProcess CloseHandle GetSystemTimePreciseAsFileTime HeapReAlloc FindClose GetTempPathW HeapFree GetModuleFileNameW GetProcessHeap SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

advapi32

RevertToSelf OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCloseKey DuplicateTokenEx ImpersonateLoggedOnUser SystemFunction036 RegQueryValueExW GetTokenInformation RegSetValueExW RegOpenKeyExW

ncrypt

NCryptOpenKey NCryptFreeObject NCryptDecrypt NCryptOpenStorageProvider

crypt32

CertOpenStore CertEnumCertificatesInStore CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CryptUnprotectData CertDuplicateStore CertVerifyCertificateChainPolicy

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen

ws2_32

WSASend getsockopt bind WSAIoctl setsockopt ioctlsocket WSASocketW getsockname getpeername closesocket WSAGetLastError connect shutdown WSAStartup WSACleanup send recv getaddrinfo freeaddrinfo

ntdll

NtCreateFile NtCreateNamedPipeFile NtCancelIoFileEx NtDeviceIoControlFile RtlNtStatusToDosError NtWriteFile NtReadFile NtOpenFile

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

secur32

ApplyControlToken DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage DecryptMessage QueryContextAttributesW

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx

vcruntime140

strrchr strchr memchr _CxxThrowException memset memmove __CxxFrameHandler3 memcpy memcmp __current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-string-l1-1-0

strcmp strspn strncmp strcspn strlen

api-ms-win-crt-heap-l1-1-0

realloc free _msize malloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log __setusermatherr _dclass fabs

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initterm _crt_atexit _get_initial_narrow_environment _beginthreadex _register_thread_local_exe_atexit_callback _endthreadex _seh_filter_exe _initialize_onexit_table _set_app_type _initterm_e terminate _configure_narrow_argv _c_exit _cexit __p___argv __p___argc _initialize_narrow_environment _exit exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_95b1ee2374632e3fe5629a3c8162f8fe_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

ncrypt

crypt32

oleaut32

ws2_32

ntdll

bcrypt

bcryptprimitives

secur32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic