2026-08-07_792eccf4e4e76c2f26af94dae5cc439d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_792eccf4e4e76c2f26af94dae5cc439d_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.5MB
Sample260808-bglsbsfj5s
SHA256 5fc9119623499165fc6b42d8b4273a381ddd41dfb96cf990500e1db175a06a5a
MD5 792eccf4e4e76c2f26af94dae5cc439d
SHA1 89f512062b26c89da80f221d8279da6a7e8f2db4
SHA512 b5ca3387a1b642638f7b9febeee777ff5ab653f3fe04141827ae1d9d23cb4eaca5e2757d7b3be3b28fd3e55893b74ca7a42499c19bf97c6d9f07c50dbdb903d1
SSDEEP 49152:l7lukiHGTSnmQKT3C5SyLPGGBl6djnx2/ke94uM/HfTZyXIMSbvSIXv9bLP3iIXa:lZukfQ3jLc8XwX1Tuo2IXaku
TLSH
T157066B43F79981E9C49EC178871A9623EB32B88D5B20B39B67D44A313F67B601F9D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_792eccf4e4e76c2f26af94dae5cc439d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-07_792eccf4e4e76c2f26af94dae5cc439d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.5MB

2026-08-07_792eccf4e4e76c2f26af94dae5cc439d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 2eac26367cfd221cff65291ef8acbd9c
SHA256 5fc9119623499165fc6b42d8b4273a381ddd41dfb96cf990500e1db175a06a5a
MD5 792eccf4e4e76c2f26af94dae5cc439d
SHA1 89f512062b26c89da80f221d8279da6a7e8f2db4
SHA512 b5ca3387a1b642638f7b9febeee777ff5ab653f3fe04141827ae1d9d23cb4eaca5e2757d7b3be3b28fd3e55893b74ca7a42499c19bf97c6d9f07c50dbdb903d1
SSDEEP 49152:l7lukiHGTSnmQKT3C5SyLPGGBl6djnx2/ke94uM/HfTZyXIMSbvSIXv9bLP3iIXa:lZukfQ3jLc8XwX1Tuo2IXaku
TLSH
T157066B43F79981E9C49EC178871A9623EB32B88D5B20B39B67D44A313F67B601F9D344
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2367664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f4max_stealer.pdb

ws2_32

WSASocketW setsockopt WSAIoctl getsockopt WSASend shutdown bind WSAGetLastError getsockname getpeername WSAStartup WSACleanup send recv getaddrinfo freeaddrinfo ioctlsocket closesocket connect

kernel32

SleepEx ReadFileEx SetHandleInformation CreateThread GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx GetSystemInfo CreateEventW CancelIo GetOverlappedResult ReadFile GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW SetLastError OpenProcess DuplicateHandle SetFileCompletionNotificationModes WaitForMultipleObjects GetExitCodeProcess GetTempPathW DeleteFileW HeapAlloc CreateWaitableTimerExW SetWaitableTimer Sleep CreateIoCompletionPort GetQueuedCompletionStatusEx SetFilePointerEx FindNextFileW PostQueuedCompletionStatus WaitForSingleObject ReleaseMutex FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx SetUnhandledExceptionFilter HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI CreateMutexA SwitchToThread GetSystemTimePreciseAsFileTime WriteFileEx HeapReAlloc HeapFree GetProcessHeap GetCurrentProcessId LoadLibraryA GetCurrentThread WaitForSingleObjectEx GetTimeZoneInformationForYear SystemTimeToFileTime CopyFileExW LocalFree SetCurrentDirectoryW CreateToolhelp32Snapshot Process32First Process32Next SetThreadStackGuarantee GetCurrentThreadId GetModuleHandleW GetFinalPathNameByHandleW AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry lstrlenW WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentProcess FormatMessageA OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetModuleFileNameW GetLastError GetProcAddress GetModuleHandleA GetTickCount64 GlobalMemoryStatusEx GetLogicalProcessorInformation FindClose CloseHandle InitializeSListHead GetFileAttributesW UnlockFile

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RevertToSelf OpenProcessToken DuplicateTokenEx ImpersonateLoggedOnUser SystemFunction036 GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA

crypt32

CertGetCertificateChain CertEnumCertificatesInStore CertFreeCertificateChain CertCloseStore CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CryptUnprotectData CertDuplicateCertificateChain CertDuplicateStore CertOpenStore CertDuplicateCertificateContext

ncrypt

NCryptOpenKey NCryptFreeObject NCryptDecrypt NCryptOpenStorageProvider

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtCreateFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile NtReadFile NtOpenFile

bcrypt

BCryptGenRandom

secur32

DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA EncryptMessage FreeContextBuffer AcceptSecurityContext FreeCredentialsHandle DecryptMessage ApplyControlToken InitializeSecurityContextW

bcryptprimitives

ProcessPrng

ole32

CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateInstance

vcruntime140

__current_exception __C_specific_handler strrchr strchr memchr memmove __CxxFrameHandler3 memset memcpy memcmp __current_exception_context

api-ms-win-crt-string-l1-1-0

strcmp strspn strlen strcspn strncmp

api-ms-win-crt-heap-l1-1-0

free _msize realloc _set_new_mode malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr _dclass fabs log

api-ms-win-crt-runtime-l1-1-0

_initterm_e terminate _register_onexit_function __p___argv _beginthreadex _initialize_onexit_table _cexit _seh_filter_exe __p___argc _set_app_type _initterm exit _c_exit _exit _crt_atexit _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _endthreadex

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_792eccf4e4e76c2f26af94dae5cc439d_akira_cobalt-strike_glassworm_rusty-stealer_satacom

ws2_32

kernel32

advapi32

crypt32

ncrypt

oleaut32

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

secur32

bcryptprimitives

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic