2026-08-07_c246ffbfd77debacbf12287c4d26ee41_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_c246ffbfd77debacbf12287c4d26ee41_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 4.7MB
Sample260808-a2cjqazsat
SHA256 f239cda1ef42a89e7ae52f4e9a0300c1f4082426aee39ab476675388ca09add0
MD5 c246ffbfd77debacbf12287c4d26ee41
SHA1 28a5bdaabf3a8b4656b42fb15b2c23e88d823264
SHA512 be3773c017b75a7c50fccf1feffda116a2cc296aad9f903ee420a30451fe735bd17c95c90ef735108f0216f01e334a6c280ae26f3db00c9b261260806a4e6b62
SSDEEP 49152:KShhyTtZz3X08K7Lyhf7oSsNS/IXm/YcmvqjHFt/BhMnc1GmqmcE1XNT/+NswPrI:T/y3LIXm/YcFxzhMSXTwqiH++2
TLSH
T166366C43F6B680ECC16AC075831A6633FB72B84907217AEB56D08A353F66FD05A7D724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_c246ffbfd77debacbf12287c4d26ee41_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-07_c246ffbfd77debacbf12287c4d26ee41_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 4.7MB

2026-08-07_c246ffbfd77debacbf12287c4d26ee41_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 12bf106a3d9662ce19baff2b48497c43
SHA256 f239cda1ef42a89e7ae52f4e9a0300c1f4082426aee39ab476675388ca09add0
MD5 c246ffbfd77debacbf12287c4d26ee41
SHA1 28a5bdaabf3a8b4656b42fb15b2c23e88d823264
SHA512 be3773c017b75a7c50fccf1feffda116a2cc296aad9f903ee420a30451fe735bd17c95c90ef735108f0216f01e334a6c280ae26f3db00c9b261260806a4e6b62
SSDEEP 49152:KShhyTtZz3X08K7Lyhf7oSsNS/IXm/YcmvqjHFt/BhMnc1GmqmcE1XNT/+NswPrI:T/y3LIXm/YcFxzhMSXTwqiH++2
TLSH
T166366C43F6B680ECC16AC075831A6633FB72B84907217AEB56D08A353F66FD05A7D724
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects executables containing possible sandbox system UUIDs
Detects executables referencing many IR and analysis tools
Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3730976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dissolute.pdb

bcryptprimitives

ProcessPrng

kernel32

PostQueuedCompletionStatus WriteFile ReadFile GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes Sleep GetOverlappedResult SwitchToThread SetLastError GetFinalPathNameByHandleW CancelIoEx CreateFileW CreateThread WaitForSingleObject GetCurrentThreadId GetCurrentProcess WaitForSingleObjectEx CreateMutexA ReleaseMutex GetStdHandle GetCurrentProcessId SetWaitableTimer CreateWaitableTimerExW GetCommandLineW IsDebuggerPresent CopyFileExW DeleteFileW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA GetProcAddress lstrlenW RtlVirtualUnwind WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW GetTempPathW FormatMessageW QueryPerformanceCounter GetModuleHandleA GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetModuleFileNameW SetEnvironmentVariableW HeapQueryInformation FlushFileBuffers GetSystemTimePreciseAsFileTime CreateFileMappingW GetTickCount GetSystemTime GetSystemTimeAsFileTime GetStartupInfoW SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection QueryPerformanceFrequency TryEnterCriticalSection DeleteCriticalSection GetExitCodeProcess WaitForMultipleObjects GetConsoleMode GetConsoleOutputCP GetSystemInfo WriteConsoleW ReadFileEx SleepEx WriteFileEx FindNextFileW LocalFree SetHandleInformation GetFullPathNameW DuplicateHandle SetFileTime DeviceIoControl SetFileInformationByHandle FindFirstFileExW GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandle GetCurrentThread MapViewOfFile CancelIo CreateEventW ExitProcess CreateDirectoryW AddVectoredExceptionHandler HeapReAlloc HeapFree GetProcessHeap SetThreadStackGuarantee GetFileInformationByHandleEx FindClose GetLastError SetFilePointerEx GetModuleHandleW FreeLibrary CloseHandle GetVersion FormatMessageA LeaveCriticalSection __C_specific_handler VirtualQuery SetUnhandledExceptionFilter InitializeSListHead LoadLibraryExA VirtualProtect GetSystemDirectoryA GetWindowsDirectoryA ExpandEnvironmentStringsA

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

connect closesocket send WSACleanup WSAStartup recv getaddrinfo setsockopt getpeername WSAGetLastError getsockname WSASocketW shutdown WSASend ioctlsocket WSAIoctl getsockopt bind freeaddrinfo

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtWriteFile NtDeviceIoControlFile NtOpenFile NtCreateFile NtReadFile NtCreateNamedPipeFile _vsnprintf log memchr memcmp memcpy memmove memset qsort strchr strcmp strcspn strlen strncmp strrchr strspn

crypt32

CryptUnprotectData

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey SystemFunction036 CryptAcquireContextW CryptReleaseContext

d3d11

D3D11CreateDevice

shlwapi

PathFileExistsW

dxgi

CreateDXGIFactory1 CreateDXGIFactory

winspool.drv

GetDefaultPrinterW

winhttp

WinHttpCloseHandle WinHttpOpen

msimg32

GradientFill

user32

GetWindowLongW PeekMessageW MapVirtualKeyW GetDC GetSystemMetrics GetClientRect RegisterClassExW CharUpperBuffW ReleaseDC GetWindowRect MessageBeep LoadStringW

gdi32

CreateCompatibleDC DeleteDC GetDeviceCaps

dwrite

DWriteCreateFactory

powrprof

PowerGetActiveScheme

setupapi

SetupDiGetClassDevsW

d2d1

D2D1CreateFactory

mfplat

MFStartup MFShutdown

gdiplus

GdiplusStartup GdiplusShutdown

netapi32

NetGetJoinInformation

mscms

GetStandardColorSpaceProfileW

dcomp

DCompositionCreateDevice

comctl32

InitCommonControls

d3d12

D3D12CreateDevice

comdlg32

CommDlgExtendedError

windowscodecs

WICCreateBitmapFromSection

propsys

PSGetPropertySystem PSGetNameFromPropertyKey

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 __current_exception_context strstr __current_exception

api-ms-win-crt-heap-l1-1-0

free malloc calloc _msize realloc _set_new_mode

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _initialize_narrow_environment terminate _get_initial_narrow_environment _crt_atexit _endthreadex _beginthreadex __p___argv _initterm _cexit _initterm_e exit _exit _configure_narrow_argv _c_exit _register_thread_local_exe_atexit_callback __p___argc _register_onexit_function _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strcpy isspace tolower strncpy toupper

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

psapi

GetProcessMemoryInfo

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

921KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_c246ffbfd77debacbf12287c4d26ee41_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

crypt32

advapi32

d3d11

shlwapi

dxgi

winspool.drv

winhttp

msimg32

user32

gdi32

dwrite

powrprof

setupapi

d2d1

mfplat

gdiplus

netapi32

mscms

dcomp

comctl32

d3d12

comdlg32

windowscodecs

propsys

iphlpapi

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

psapi

generic