2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 7.0MB
Sample260807-3sd1eaae84
SHA256 993d96bfcf8e3428114dab432f72940ad688b08d7b6842b6b869d8a94ddb5ddd
MD5 99ec9cc50d19b7aa4293f8064132beb5
SHA1 e6e90a43b96a57f5590c4968bc4c649a5a1dead7
SHA512 1fe6fc6dc2772fe72494b623e7171efd440c4f3e987d7b782e1c34fa143f960ce9477cd7cd9725000484c591035d4b0dcdc2c7b6a9a92c92deec111fd17b9f8b
SSDEEP 49152:vGGib8SRMq1lNr/GuaYkaH4n8e7wZUVGerVg90pJl8kcZ++QbGCLJaXm32dkL0TT:QRMI4Dw+0ucz8ZypazAR
TLSH
T12D7606216E9A99ADC19AC47483478A725E3130CF1B35B9FF448486383F69AF52F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 7.0MB

2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH a8534f4386a47a809db19c0aa1c9a5d0
SHA256 993d96bfcf8e3428114dab432f72940ad688b08d7b6842b6b869d8a94ddb5ddd
MD5 99ec9cc50d19b7aa4293f8064132beb5
SHA1 e6e90a43b96a57f5590c4968bc4c649a5a1dead7
SHA512 1fe6fc6dc2772fe72494b623e7171efd440c4f3e987d7b782e1c34fa143f960ce9477cd7cd9725000484c591035d4b0dcdc2c7b6a9a92c92deec111fd17b9f8b
SSDEEP 49152:vGGib8SRMq1lNr/GuaYkaH4n8e7wZUVGerVg90pJl8kcZ++QbGCLJaXm32dkL0TT:QRMI4Dw+0ucz8ZypazAR
TLSH
T12D7606216E9A99ADC19AC47483478A725E3130CF1B35B9FF448486383F69AF52F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4902804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MicrosoftEdgeUpdate.pdb

kernel32

SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetFileAttributesW GetStringTypeW EndUpdateResourceW GetCPInfo UpdateResourceW BeginUpdateResourceW GetOEMCP GetACP EnumResourceNamesW GetModuleHandleW LockResource IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA DeleteCriticalSection SetHandleInformation InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead HeapSize LoadLibraryExW VirtualProtect SetStdHandle IsProcessorFeaturePresent GetCurrentProcess DuplicateHandle CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetModuleHandleExW FlsFree FlsSetValue FlsGetValue GetOverlappedResult ReadFile WriteFile FlsAlloc SetFileCompletionNotificationModes GetStartupInfoW GetSystemTimeAsFileTime SizeofResource LoadResource FindResourceW FindNextFileW RtlVirtualUnwind Sleep GetModuleHandleA SetFileAttributesW OpenProcess FreeLibrary GetProcAddress LoadLibraryA CompareStringW GetLastError CreateMutexW LCMapStringW CloseHandle AllocConsole RtlLookupFunctionEntry RtlCaptureContext CreateToolhelp32Snapshot Process32FirstW TerminateProcess Process32NextW GetProcessHeap HeapFree HeapReAlloc lstrlenW WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle FlushFileBuffers SetFileTime GetProcessId WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetExitCodeProcess GetSystemInfo GetCurrentThreadId QueryPerformanceCounter CopyFileExW MoveFileExW CreateDirectoryW GetFinalPathNameByHandleW GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime SwitchToThread CreateFileW CreateEventW GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose GetFileType FormatMessageW SetEnvironmentVariableW WriteFileEx GetFullPathNameW GetTempPathW GetModuleFileNameW ExitProcess QueryPerformanceFrequency CreateProcessW CancelIo GetWindowsDirectoryW GetSystemDirectoryW HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer CreateThread WaitForMultipleObjects ReadFileEx SleepEx FreeEnvironmentStringsW CompareStringOrdinal

ws2_32

bind WSASocketW WSAIoctl connect shutdown setsockopt getsockopt getpeername getsockname send WSASend recv closesocket ioctlsocket WSAGetLastError getaddrinfo freeaddrinfo select WSAStartup WSACleanup

secur32

AcquireCredentialsHandleA FreeCredentialsHandle QueryContextAttributesW DecryptMessage DeleteSecurityContext ApplyControlToken EncryptMessage FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext

crypt32

CertDuplicateCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertCloseStore CertEnumCertificatesInStore

bcrypt

BCryptGenRandom

advapi32

SystemFunction036 RegSetValueExW RegCreateKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtOpenFile RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtCreateNamedPipeFile NtReadFile NtCancelIoFileEx NtWriteFile

bcryptprimitives

ProcessPrng

user32

GetWindowTextW EnumWindows

psapi

GetModuleFileNameExW

Name

.text

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_99ec9cc50d19b7aa4293f8064132beb5_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

kernel32

ws2_32

secur32

crypt32

bcrypt

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

user32

psapi

generic