2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 4.8MB
Sample260802-dfswcscc46
SHA256 329bbf3e440e49a6b85efa40632638e1dce79b0e66b802adc4f29d325fddf4f8
MD5 7fab468b4ef8a190345a0d905e33f615
SHA1 81153c400f66fc4ef78399732ac5744c3291abe3
SHA512 ae95ef8c7a444b207061a977d399790b54f3d179c911200a40f138fbb10eb006919f9433f5ad23832eb9cdd0a5058fb822dfbc7b2c39469a4defea1ef8685538
SSDEEP 49152:i6OsxijTXciu5z7u6cvZYNrFSR5zJ4o6Ueqg0IG7rrkb5/1dFpJFf4X6CGGuNCng:i6OWMss6VqgYHkrxMGWnnkvB
TLSH
T132366B02BE5649D9D09AC870C7868A679B3274DF0A35FAFF11C505253FAABB12F1C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 4.8MB

2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 36ced7a8f893d84040e9010fdba5fcd3
SHA256 329bbf3e440e49a6b85efa40632638e1dce79b0e66b802adc4f29d325fddf4f8
MD5 7fab468b4ef8a190345a0d905e33f615
SHA1 81153c400f66fc4ef78399732ac5744c3291abe3
SHA512 ae95ef8c7a444b207061a977d399790b54f3d179c911200a40f138fbb10eb006919f9433f5ad23832eb9cdd0a5058fb822dfbc7b2c39469a4defea1ef8685538
SSDEEP 49152:i6OsxijTXciu5z7u6cvZYNrFSR5zJ4o6Ueqg0IG7rrkb5/1dFpJFf4X6CGGuNCng:i6OWMss6VqgYHkrxMGWnnkvB
TLSH
T132366B02BE5649D9D09AC870C7868A679B3274DF0A35FAFF11C505253FAABB12F1C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3223312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f4max_stealer.pdb

kernel32

CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx SetHandleInformation CreateDirectoryW CreateEventW CancelIo GetOverlappedResult ReadFile GetCurrentThreadId GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetProcAddress DuplicateHandle GetModuleHandleW WaitForMultipleObjects GetExitCodeProcess GetTempPathW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep WriteFileEx SleepEx SetFilePointerEx FindNextFileW PostQueuedCompletionStatus ReadFileEx WaitForSingleObjectEx HeapAlloc WaitForSingleObject LoadLibraryA ReleaseMutex CreateMutexA GetQueuedCompletionStatusEx GetSystemDirectoryW GetFinalPathNameByHandleW SetFileCompletionNotificationModes CreateIoCompletionPort GetProcessHeap SwitchToThread GetTimeZoneInformationForYear SystemTimeToFileTime GetCurrentThread SetThreadStackGuarantee SetCurrentDirectoryW LocalFree CreateToolhelp32Snapshot Process32First Process32Next GetCurrentProcessId OpenProcess GetCurrentProcess SetLastError AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetFileAttributesW GetLastError GetTickCount64 InitializeSListHead GlobalMemoryStatusEx GetLogicalProcessorInformation GetSystemInfo CloseHandle GetSystemTimePreciseAsFileTime HeapReAlloc FindClose HeapFree GetModuleFileNameW SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

advapi32

RegCloseKey GetTokenInformation RegOpenKeyExW RevertToSelf RegQueryValueExW RegSetValueExW ImpersonateLoggedOnUser DuplicateTokenEx SystemFunction036 OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges

ws2_32

closesocket getsockopt WSASend WSAIoctl setsockopt ioctlsocket WSASocketW getsockname getpeername bind shutdown WSAStartup WSACleanup send recv getaddrinfo WSAGetLastError connect freeaddrinfo

ncrypt

NCryptFreeObject NCryptDecrypt NCryptOpenStorageProvider NCryptOpenKey

crypt32

CryptUnprotectData CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertOpenStore CertDuplicateStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore

oleaut32

SysStringByteLen SysFreeString SysAllocStringByteLen

ntdll

NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile NtReadFile NtOpenFile

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

secur32

ApplyControlToken DeleteSecurityContext AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage DecryptMessage QueryContextAttributesW

ole32

CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeEx

vcruntime140

__C_specific_handler __current_exception_context strrchr strchr memchr _CxxThrowException __current_exception memset memmove __CxxFrameHandler3 memcpy memcmp

api-ms-win-crt-string-l1-1-0

strncmp strcmp strcspn strlen strspn

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc malloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log fabs _dclass __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_set_app_type _crt_atexit _configure_narrow_argv _seh_filter_exe _register_thread_local_exe_atexit_callback _endthreadex _beginthreadex terminate _initialize_narrow_environment _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _c_exit _cexit __p___argv __p___argc _register_onexit_function _exit exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_7fab468b4ef8a190345a0d905e33f615_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

ws2_32

ncrypt

crypt32

oleaut32

ntdll

bcrypt

bcryptprimitives

secur32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic