329bbf3e440e49a6b85efa40632638e1dce79b0e66b802adc4f29d325fddf4f8

General

Target
2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 4.8MB
Sample260802-dfswcscc46
SHA256 329bbf3e440e49a6b85efa40632638e1dce79b0e66b802adc4f29d325fddf4f8
MD5 7fab468b4ef8a190345a0d905e33f615
SHA1 81153c400f66fc4ef78399732ac5744c3291abe3
SHA512 ae95ef8c7a444b207061a977d399790b54f3d179c911200a40f138fbb10eb006919f9433f5ad23832eb9cdd0a5058fb822dfbc7b2c39469a4defea1ef8685538
SSDEEP 49152:i6OsxijTXciu5z7u6cvZYNrFSR5zJ4o6Ueqg0IG7rrkb5/1dFpJFf4X6CGGuNCng:i6OWMss6VqgYHkrxMGWnnkvB
TLSH
T132366B02BE5649D9D09AC870C7868A679B3274DF0A35FAFF11C505253FAABB12F1C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 4.8MB
- SHA256 329bbf3e440e49a6b85efa40632638e1dce79b0e66b802adc4f29d325fddf4f8
- MD5 7fab468b4ef8a190345a0d905e33f615
- SHA1 81153c400f66fc4ef78399732ac5744c3291abe3
- SHA512 ae95ef8c7a444b207061a977d399790b54f3d179c911200a40f138fbb10eb006919f9433f5ad23832eb9cdd0a5058fb822dfbc7b2c39469a4defea1ef8685538
- SSDEEP 49152:i6OsxijTXciu5z7u6cvZYNrFSR5zJ4o6Ueqg0IG7rrkb5/1dFpJFf4X6CGGuNCng:i6OWMss6VqgYHkrxMGWnnkvB
- TLSH
  T132366B02BE5649D9D09AC870C7868A679B3274DF0A35FAFF11C505253FAABB12F1C358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery persistence spyware stealer
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables Discord URL observed in first stage droppers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2