2026-08-02_7eacfcdb21e69aabd300cc17c64477a7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_7eacfcdb21e69aabd300cc17c64477a7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 11.3MB
Sample260802-rg3nvavblh
SHA256 a68e60d32ddffb6c3fbd0ccc27c8fe0199b9861a83843be5378298158e77255e
MD5 7eacfcdb21e69aabd300cc17c64477a7
SHA1 29459f0aa8b24a1c782faa92dc65c7541689ccdc
SHA512 079bb87393119af7efb097715291ece350f43c786226d80b3a07b43a5ff348a98f84a3ca1d850a22c8d0dea299480879ec8f298f124692066809ef0b1fe9f58b
SSDEEP 24576:3ZVhuI5qtYg/YvO5LxC+qiO9Y3+psCLO0V/c6BdBijX1o/FsYgtpQpSUR:HdjFvO5ZE60V/c6BjUXomtpQp/
TLSH
T166C63A13BA5A99DDC549C878C25646721B3274DA0F31AAFF21C4263C3E7EAE51F3C264
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_7eacfcdb21e69aabd300cc17c64477a7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-02_7eacfcdb21e69aabd300cc17c64477a7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 11.3MB

2026-08-02_7eacfcdb21e69aabd300cc17c64477a7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH ebf9d5ee428cb0f90e139ba82e4c4b15
SHA256 a68e60d32ddffb6c3fbd0ccc27c8fe0199b9861a83843be5378298158e77255e
MD5 7eacfcdb21e69aabd300cc17c64477a7
SHA1 29459f0aa8b24a1c782faa92dc65c7541689ccdc
SHA512 079bb87393119af7efb097715291ece350f43c786226d80b3a07b43a5ff348a98f84a3ca1d850a22c8d0dea299480879ec8f298f124692066809ef0b1fe9f58b
SSDEEP 24576:3ZVhuI5qtYg/YvO5LxC+qiO9Y3+psCLO0V/c6BdBijX1o/FsYgtpQpSUR:HdjFvO5ZE60V/c6BjUXomtpQp/
TLSH
T166C63A13BA5A99DDC549C878C25646721B3274DA0F31AAFF21C4263C3E7EAE51F3C264
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

692032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

monika_bootstrap.pdb

kernel32

HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFileInformationByHandle DuplicateHandle WaitForSingleObject CreateEventW FormatMessageW HeapFree SetHandleInformation AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetLastError FreeLibrary LoadLibraryExA HeapAlloc GetProcessHeap GetVolumeInformationW TerminateProcess OpenProcess GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime CreateDirectoryW GetFileInformationByHandleEx InitializeSListHead CreateFileW GetOverlappedResult GetFileInformationByHandle FindFirstFileExW FindClose GetConsoleMode SetUnhandledExceptionFilter LocalFree CloseHandle RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetProcessId GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetModuleFileNameW ExitProcess WaitForMultipleObjects ReadFileEx SleepEx ReadFile QueryPerformanceFrequency GetExitCodeProcess CancelIo QueryPerformanceCounter MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx

advapi32

CreateWellKnownSid LookupAccountSidW SetFileSecurityW CheckTokenMembership LookupAccountNameW OpenSCManagerW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW ControlService SystemFunction036 ChangeServiceConfigW QueryServiceStatus CreateServiceW RegGetValueW CloseServiceHandle

secur32

InitializeSecurityContextW AcceptSecurityContext FreeCredentialsHandle DecryptMessage FreeContextBuffer AcquireCredentialsHandleA QueryContextAttributesW EncryptMessage DeleteSecurityContext

crypt32

CertOpenStore CertGetCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertDuplicateStore CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertDuplicateCertificateChain

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

wtsapi32

WTSQueryUserToken WTSFreeMemoryExW WTSEnumerateSessionsExW

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree

netapi32

NetUserSetInfo NetLocalGroupAddMembers NetUserAdd NetLocalGroupDelMembers

user32

MessageBoxW

ws2_32

recv send WSADuplicateSocketW closesocket getaddrinfo WSASocketW getsockname ioctlsocket WSAGetLastError getpeername WSARecv WSASend connect setsockopt select WSAStartup getsockopt WSACleanup freeaddrinfo

oleaut32

SysFreeString SysStringLen GetErrorInfo

ntdll

NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile NtOpenFile

vcruntime140

__CxxFrameHandler3 memcmp memcpy __current_exception_context __C_specific_handler _CxxThrowException memmove __current_exception memset

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv __p___argc _exit _register_thread_local_exe_atexit_callback _register_onexit_function _set_app_type _initterm_e exit terminate _c_exit _configure_narrow_argv _crt_atexit _initialize_narrow_environment _initterm _seh_filter_exe _initialize_onexit_table _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_7eacfcdb21e69aabd300cc17c64477a7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

advapi32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

iphlpapi

wtsapi32

shell32

ole32

netapi32

user32

ws2_32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic