2026-08-03_b1ae8c519fbe2c4f42f1fa0d4be1423b_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_b1ae8c519fbe2c4f42f1fa0d4be1423b_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom
Size 46.0MB
Sample260803-fe8arscb86
SHA256 f537cc65c1791d9d1a022132302b21ecd48cdf0a605a7b345809fbe8af4e807d
MD5 b1ae8c519fbe2c4f42f1fa0d4be1423b
SHA1 15538f7f1ba7d0589258be8213e3500fed26a004
SHA512 820438942af12bc44078e7ae364fd8ae1e96730f6678c895ac789ad976685707f270f48beb9b734d94d76c398cfa01b672af9153a994a621782fedc907208a42
SSDEEP 393216:eUd5uZ/eQ/G13ZtK+Zq14pnxrvbIHuX7e9DMQZC6GVe6OQm+Her:hdIZ/eQ/G1rq1KNvEHI7e9DMQbIOEHK
TLSH
T17AB73843F7A191E9D169C474934AA233FB71BC8D46307AEB5BE08B212F25F90A63D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_b1ae8c519fbe2c4f42f1fa0d4be1423b_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

File Explorer

2026-08-03_b1ae8c519fbe2c4f42f1fa0d4be1423b_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

.exe 46.0MB

2026-08-03_b1ae8c519fbe2c4f42f1fa0d4be1423b_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

IMPHASH da8ce506705f6fc6de2c29f9b31bda7c
SHA256 f537cc65c1791d9d1a022132302b21ecd48cdf0a605a7b345809fbe8af4e807d
MD5 b1ae8c519fbe2c4f42f1fa0d4be1423b
SHA1 15538f7f1ba7d0589258be8213e3500fed26a004
SHA512 820438942af12bc44078e7ae364fd8ae1e96730f6678c895ac789ad976685707f270f48beb9b734d94d76c398cfa01b672af9153a994a621782fedc907208a42
SSDEEP 393216:eUd5uZ/eQ/G13ZtK+Zq14pnxrvbIHuX7e9DMQZC6GVe6OQm+Her:hdIZ/eQ/G1rq1KNvEHI7e9DMQbIOEHK
TLSH
T17AB73843F7A191E9D169C474934AA233FB71BC8D46307AEB5BE08B212F25F90A63D705
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38194656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

uv.pdb

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtReadFile NtOpenFile RtlGetVersion

advapi32

RegOpenKeyExW RegCloseKey RegDeleteTreeW RegSetValueExW RegQueryInfoKeyW RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegDeleteValueW RegEnumKeyExW RegGetValueA RegQueryValueExW SystemFunction036 CredWriteW CredFree CredReadW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CredDeleteW LookupPrivilegeValueA

kernel32

FindNextFileW ReadFile GetOverlappedResult PostQueuedCompletionStatus WriteFile CancelIoEx GetCPInfo CreateIoCompletionPort SetFileCompletionNotificationModes GetQueuedCompletionStatusEx GetModuleHandleA GetProcAddress DeviceIoControl SetFileInformationByHandle GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW GetModuleFileNameW GetCommandLineW GetOEMCP DeleteFileW LocalFree CreateProcessA ExitProcess GetCurrentProcess DuplicateHandle GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW ReadFileEx GetModuleHandleW FormatMessageW SetHandleInformation CreateThread GetCurrentThread SetThreadStackGuarantee GetFullPathNameW SetFileTime FindFirstFileExW ReadConsoleW CreateEventW CreateDirectoryW GetExitCodeProcess WaitForMultipleObjects CancelIo TerminateProcess CompareStringOrdinal CreateProcessW GetFileAttributesW GetACP GetTempPathW RemoveDirectoryW SetConsoleTextAttribute SetFileAttributesW CopyFileExW MoveFileExW CreateSymbolicLinkW CreateHardLinkW GetFileType SetConsoleCtrlHandler UnregisterWaitEx RegisterWaitForSingleObject SetCurrentDirectoryW CreateSemaphoreA SetUnhandledExceptionFilter SetEnvironmentVariableW GetNumberOfConsoleInputEvents UnlockFile GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode IsValidCodePage GetStdHandle GetCurrentProcessId SetConsoleCursorPosition SetStdHandle GetFileInformationByHandle SetFilePointerEx BeginUpdateResourceW UpdateResourceW EndUpdateResourceW LoadLibraryExW FreeLibrary FindResourceW SizeofResource LoadResource LockResource GetModuleHandleExA GetFileSizeEx FlushFileBuffers LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue LoadLibraryW FillConsoleOutputAttribute LCMapStringW LockFileEx GetSystemTimePreciseAsFileTime CompareStringW CreateFileMappingW MapViewOfFile VirtualProtect OutputDebugStringW UnhandledExceptionFilter GetSystemInfo FillConsoleOutputCharacterA FlushProcessWriteBuffers IsDebuggerPresent GetCommandLineA GetStringTypeW SetNamedPipeHandleState SetEndOfFile ReadConsoleInputW SwitchToThread ReleaseSemaphore IsProcessorFeaturePresent GetModuleHandleExW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection Sleep WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW SetConsoleCursorInfo EncodePointer HeapReAlloc FlsFree FlsSetValue FlsGetValue GetSystemDirectoryW GetWindowsDirectoryW FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx UnmapViewOfFile WriteFileEx GetFileInformationByHandleEx FindClose GetDynamicTimeZoneInformation HeapFree HeapAlloc GetProcessHeap CloseHandle GetConsoleCursorInfo AddVectoredExceptionHandler GetSystemTimeAsFileTime GetBinaryTypeW GetLastError SleepEx HeapSize GetFinalPathNameByHandleW GetStartupInfoW InitializeSListHead WriteConsoleA VirtualQuery VirtualFree VirtualAlloc GetCurrentProcessorNumber GetProcessTimes TryAcquireSRWLockExclusive QueryPerformanceCounter GetEnvironmentVariableA QueryPerformanceFrequency

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

userenv

GetUserProfileDirectoryW

oleaut32

SysFreeString SysStringLen GetErrorInfo

user32

SendMessageTimeoutW

cfgmgr32

CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW

ws2_32

getsockname WSASocketW getpeername shutdown send setsockopt WSAIoctl recv bind connect closesocket getsockopt ioctlsocket freeaddrinfo WSASend WSACleanup WSAStartup WSAGetLastError getaddrinfo

bcrypt

BCryptGenRandom

crypt32

CertSetCertificateContextProperty CertOpenStore CertCloseStore CertGetCertificateChain CertFreeCertificateContext CertAddEncodedCertificateToStore CertFreeCertificateChainEngine CertFreeCertificateChain CertVerifyCertificateChainPolicy CertCreateCertificateChainEngine

Name

.text

Size

38.5MB

Virtual Size

38.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

65KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

449KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dep-v0

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_b1ae8c519fbe2c4f42f1fa0d4be1423b_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

ntdll

advapi32

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

shell32

ole32

userenv

oleaut32

user32

cfgmgr32

ws2_32

bcrypt

crypt32

generic