2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom
Size 1.8MB
Sample260807-me2xbasgph
SHA256 6ae2d88bf82afae499f1cf40e99c03328f93bea237bce15da172c6828b74a32d
MD5 1211795a3e450f724b971f0cc1e06a21
SHA1 292b0202517b93f4d1b2f6aeccabd55b4b12f648
SHA512 d435c858db2f01bf1102b746ce28739f47adc1edf1690d6cfb92c8b1ded67240658ca099641eba2017a742e4bf2671a04584ea897284186c30711abd5af76ea1
SSDEEP 49152:iOXGdYthkj2behCM7oTudeAtMPEUOaiR4fijAcL:ib8WZgudehPjHs4fs
TLSH
T18085F10666A400B8D2ABC078C7538D17EA32B8860F71B9EF13E466691F37BE45B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

File Explorer

2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

.exe 1.8MB

2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

IMPHASH 266da185c57e05474127f35d07a58d97
SHA256 6ae2d88bf82afae499f1cf40e99c03328f93bea237bce15da172c6828b74a32d
MD5 1211795a3e450f724b971f0cc1e06a21
SHA1 292b0202517b93f4d1b2f6aeccabd55b4b12f648
SHA512 d435c858db2f01bf1102b746ce28739f47adc1edf1690d6cfb92c8b1ded67240658ca099641eba2017a742e4bf2671a04584ea897284186c30711abd5af76ea1
SSDEEP 49152:iOXGdYthkj2behCM7oTudeAtMPEUOaiR4fijAcL:ib8WZgudehPjHs4fs
TLSH
T18085F10666A400B8D2ABC078C7538D17EA32B8860F71B9EF13E466691F37BE45B3D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

256480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rustrust.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

ReadFile SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetTempPathW GetExitCodeProcess CloseHandle FindClose DeleteFileW GetLastError SetFileInformationByHandle FindFirstFileExW GetCommandLineW SetFilePointerEx QueryPerformanceFrequency SwitchToThread CopyFileExW GetSystemTimePreciseAsFileTime FindNextFileW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW QueryPerformanceCounter CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW CancelIo GetOverlappedResult CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile NtOpenFile

vcruntime140

__CxxFrameHandler3 memcpy memset __current_exception_context __current_exception memcmp __C_specific_handler memmove

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_1211795a3e450f724b971f0cc1e06a21_akira_cobalt-strike_glassworm_icedid_njrat_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic