Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_a9c1468949360cd7c11791d99daeb805_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_a9c1468949360cd7c11791d99daeb805_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-03_a9c1468949360cd7c11791d99daeb805_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
- Size 11.5MB
- Sample260803-ffh29scb94
- SHA256 5daeb37b6c8f80a0e5f4940824329fa9ce43fd3add10713b44dee82b56299189
- MD5 a9c1468949360cd7c11791d99daeb805
- SHA1 06d4870ba9c24dbc8344a8bb4189db3d838d1e90
- SHA512 b7b3b5fd94920a934034b59b999f2be12317944949e0c93eab8987b1b5db32722fb3deca28300e6070ce5527223f4264de475fd494ff86c3d4275c7935ccfbb4
- SSDEEP 49152:AxeFPLwg+KuGTNeGaGy6IMS8k439MBBmM036ux+GOUmcs71XwMmRDN+B74MQcn8j:DPS9vsHUjSXb2FE2Fu+s9n+oP
- TLSH T1A3C63B063C1A0EAEC198C5F4C2E36592892D30CFA5F5DDBAEDD48C175E9DAA41E3E344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: LoadsDriver 30 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4280 2026-08-03_a9c1468949360cd7c11791d99daeb805_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4280 2026-08-03_a9c1468949360cd7c11791d99daeb805_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_a9c1468949360cd7c11791d99daeb805_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a9c1468949360cd7c11791d99daeb805_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4280
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\reliquary-archiver\settings.json
- Size 292B
- SHA256 9d14304f07eec8e9cacf990ac9b7d14237937e46eeaa6e030be900d1b0789931
- MD5 1cb29043955ed50115c16a416e71be53
- SHA1 d01b1ddbf20eaa784835e2cbac806089bacd3742
- SHA512 6ac73b0e94406bcf0b02fbfc7947c7c76a3e1dfdccbe4ecca330184e719d62709a8b51b1099225a5425693e8ddd4f9d74e8d1edcd941b9576840d02c51c07b9e
- TLSH T16DE01211C01211EEB9E181799ABFC3675B001DA4955C7F59CB679804FA5D73131F3CD5
- MD5 SHA1 SHA512 TLSH