2026-08-03_745759e0d8cffa849f812f5ec55a63f7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_745759e0d8cffa849f812f5ec55a63f7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.7MB
Sample260804-c9qsestyfy
SHA256 8f58a5e8fd677b7ff4a0e9c83ade93bd31c62f14b26e2686380f9d147ed654a2
MD5 745759e0d8cffa849f812f5ec55a63f7
SHA1 f5312bd1d9f2fbbc6fac34623aa841d3cfb2ef7e
SHA512 1e9c87b650bac40f18ff144b2839fd64a24184e133b294bfbe67c8461255dc643f54237d62eb5b5a7a1a142a0c9e733bc1cf9b068e0617fa5e5f6f6595f14e11
SSDEEP 49152:8VB5SEEufew5J1b4QB/XDyfiHTJmNGJpI+3tg86kf7z719srC7/W0mkNrhCyG:cbD9qwmNQpiaWpuC
TLSH
T1BD068D03FB9582F9D05EC178C75A9233EBB2BC495620B29B27D44A223F67B604F5D349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_745759e0d8cffa849f812f5ec55a63f7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-03_745759e0d8cffa849f812f5ec55a63f7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.7MB

2026-08-03_745759e0d8cffa849f812f5ec55a63f7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 89153fd9203156924293593035d15276
SHA256 8f58a5e8fd677b7ff4a0e9c83ade93bd31c62f14b26e2686380f9d147ed654a2
MD5 745759e0d8cffa849f812f5ec55a63f7
SHA1 f5312bd1d9f2fbbc6fac34623aa841d3cfb2ef7e
SHA512 1e9c87b650bac40f18ff144b2839fd64a24184e133b294bfbe67c8461255dc643f54237d62eb5b5a7a1a142a0c9e733bc1cf9b068e0617fa5e5f6f6595f14e11
SSDEEP 49152:8VB5SEEufew5J1b4QB/XDyfiHTJmNGJpI+3tg86kf7z719srC7/W0mkNrhCyG:cbD9qwmNQpiaWpuC
TLSH
T1BD068D03FB9582F9D05EC178C75A9233EBB2BC495620B29B27D44A223F67B604F5D349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2702300

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

private_rust.pdb

user32

OpenClipboard GetClipboardData CloseClipboard ShowWindow MessageBoxW GetSystemMetrics

bcryptprimitives

ProcessPrng

kernel32

GetProcAddress CreateFileW FindNextFileW SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW SetFileTime LoadLibraryA GetFileInformationByHandle GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime GetModuleFileNameW GetTempPathW SetThreadStackGuarantee CreateMutexA SetFilePointerEx GetCurrentProcessId WaitForSingleObject WaitForSingleObjectEx GetCurrentProcess ReleaseMutex GetCurrentThreadId GetCommandLineW GetConsoleWindow AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LocalFree WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime GetModuleHandleW SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CancelIoEx GlobalUnlock GlobalLock WriteFile GetTickCount64 GlobalMemoryStatusEx GetSystemInfo SetFileInformationByHandle DeleteFileW FindClose FormatMessageW GetLastError SetFileCompletionNotificationModes InitializeSListHead HeapAlloc HeapFree GetProcessHeap CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus CloseHandle FreeLibrary GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError GetCurrentThread SwitchToThread lstrlenW HeapReAlloc FindFirstFileExW SetUnhandledExceptionFilter

advapi32

RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSASend recv WSASocketW ioctlsocket getsockopt bind setsockopt WSAIoctl WSAStartup WSACleanup getaddrinfo getpeername freeaddrinfo send getsockname closesocket WSAGetLastError connect shutdown

ntdll

NtCreateFile NtReadFile RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile

crypt32

CertAddCertificateContextToStore CertCloseStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertOpenStore

secur32

DeleteSecurityContext EncryptMessage AcquireCredentialsHandleA QueryContextAttributesW FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle

vcruntime140

strchr strrchr memcpy __C_specific_handler __current_exception __current_exception_context memset __CxxFrameHandler3 memcmp memmove memchr

api-ms-win-crt-string-l1-1-0

strspn strlen strcspn strncmp strcmp

api-ms-win-crt-math-l1-1-0

_dclass log fabs log2 __setusermatherr

api-ms-win-crt-heap-l1-1-0

calloc free malloc _msize realloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit _initterm _get_initial_narrow_environment _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit terminate _wassert _register_thread_local_exe_atexit_callback _configure_narrow_argv _set_app_type _seh_filter_exe _endthreadex _crt_atexit _beginthreadex exit _register_onexit_function _initialize_onexit_table

api-ms-win-crt-utility-l1-1-0

_rotl64 qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_745759e0d8cffa849f812f5ec55a63f7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

user32

bcryptprimitives

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

crypt32

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic