2026-08-08_bcb8b0ac981ca65bf054d5aab6bdecdf_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_bcb8b0ac981ca65bf054d5aab6bdecdf_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom
Size 43.1MB
Sample260808-da2lbayejb
SHA256 671c5099311123f4598c4d3e5376845e515a2270f2eea0c9398a35c07646c5e1
MD5 bcb8b0ac981ca65bf054d5aab6bdecdf
SHA1 adb198ae272adc558a2fed67ae001e40865b31cd
SHA512 cd1388af3088de628dc06de35778dc349d33bcf4f6bf695b4ecc49010f510e13e169af752844da58f35d2187a07cce467a58f51e3cd764e4551811cc194d58fc
SSDEEP 393216:YyhmHOVOTGMCKTfEabeAXN86ERPO9xTUJqEHB:iHOVORlT26EhgFUH
TLSH
T183A78E02FBAD5ED4C561843CB9721321BB31FC9FD311A7E716A4F2313D126D0AE6A269
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_bcb8b0ac981ca65bf054d5aab6bdecdf_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

File Explorer

2026-08-08_bcb8b0ac981ca65bf054d5aab6bdecdf_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

.exe 43.1MB

2026-08-08_bcb8b0ac981ca65bf054d5aab6bdecdf_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

IMPHASH 09c9d0da40f855d38527d58c7a7c281b
SHA256 671c5099311123f4598c4d3e5376845e515a2270f2eea0c9398a35c07646c5e1
MD5 bcb8b0ac981ca65bf054d5aab6bdecdf
SHA1 adb198ae272adc558a2fed67ae001e40865b31cd
SHA512 cd1388af3088de628dc06de35778dc349d33bcf4f6bf695b4ecc49010f510e13e169af752844da58f35d2187a07cce467a58f51e3cd764e4551811cc194d58fc
SSDEEP 393216:YyhmHOVOTGMCKTfEabeAXN86ERPO9xTUJqEHB:iHOVORlT26EhgFUH
TLSH
T183A78E02FBAD5ED4C561843CB9721321BB31FC9FD311A7E716A4F2313D126D0AE6A269
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9645168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

codey.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

WriteFile ReadFileEx CreateDirectoryW SetFileTime GetFinalPathNameByHandleW WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP FindNextFileW MultiByteToWideChar WriteConsoleW SetFileAttributesW RemoveDirectoryW GetFullPathNameW SetFileInformationByHandle FindFirstFileExW ReadConsoleW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW FindClose lstrlenW GetTempPathW DeleteFileW CopyFileExW SetFileCompletionNotificationModes FlushFileBuffers UnlockFile ReOpenFile SetFilePointerEx CreateFileW GetSystemInfo LockFileEx ReadFile GetTickCount GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetACP AreFileApisANSI GetSystemTimePreciseAsFileTime FormatMessageW CloseHandle RegisterWaitForSingleObject UnregisterWaitEx SetWaitableTimer CreateWaitableTimerExW WaitForMultipleObjects CreateProcessW CancelIo CreateEventW ExitProcess SetHandleInformation ReleaseMutex CreateMutexA WaitForSingleObjectEx GetCurrentThreadId Sleep CancelIoEx SetLastError CreateIoCompletionPort GetOverlappedResult GetQueuedCompletionStatusEx DuplicateHandle TerminateJobObject ResumeThread OpenThread Thread32Next Thread32First AssignProcessToJobObject SetInformationJobObject CreateJobObjectW SleepEx SwitchToThread LocalFree GetCurrentProcess TerminateProcess QueryFullProcessImageNameW GetProcessTimes HeapAlloc WriteFileEx OpenProcess GetFileInformationByHandle MoveFileExW ReplaceFileW CreateThread GetExitCodeProcess HeapFree WaitForSingleObject GetCurrentThread SetThreadStackGuarantee GetProcessId Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcessId GetLastError PostQueuedCompletionStatus GetProcessHeap CreatePipe GetDiskFreeSpaceW GetTimeZoneInformationForYear GetModuleHandleA GetFileInformationByHandleEx LoadLibraryExA SetConsoleCtrlHandler GetProcAddress SetUnhandledExceptionFilter InitializeSListHead HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter GetModuleFileNameW GetCommandLineW MapViewOfFile CreateFileMappingW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection FormatMessageA SystemTimeToFileTime EnterCriticalSection HeapDestroy InitializeCriticalSection RaiseException HeapCreate OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize OutputDebugStringW FlushViewOfFile LoadLibraryW HeapCompact

ntdll

NtWriteFile NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile NtOpenFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError

advapi32

RegOpenKeyExW SystemFunction036 OpenProcessToken GetTokenInformation GetSecurityDescriptorDacl RegCloseKey ConvertSidToStringSidW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW

oleaut32

GetErrorInfo SysStringLen SysFreeString

combase

CoTaskMemFree

bcryptprimitives

ProcessPrng

ws2_32

WSAStartup bind listen setsockopt connect ioctlsocket WSASocketW getsockname getpeername getaddrinfo freeaddrinfo recv send shutdown WSAGetLastError getsockopt closesocket WSASend WSACleanup WSAIoctl

shell32

SHCreateItemFromParsingName SHGetKnownFolderPath

ole32

CoUninitialize CoCreateInstance CoInitializeEx

userenv

GetUserProfileDirectoryW

user32

MessageBoxW

bcrypt

BCryptGenRandom

vcruntime140

__current_exception __current_exception_context __C_specific_handler memchr memcpy memcmp memmove memset __CxxFrameHandler3 strchr strrchr

api-ms-win-crt-string-l1-1-0

strcspn strspn strlen strcmp strncmp

api-ms-win-crt-math-l1-1-0

ceil __setusermatherr log fmod round pow

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _msize realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _get_initial_narrow_environment _initialize_narrow_environment _initterm_e _configure_narrow_argv _register_onexit_function _initialize_onexit_table _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _set_app_type _endthreadex _seh_filter_exe _crt_atexit exit _initterm

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_bcb8b0ac981ca65bf054d5aab6bdecdf_akira_cobalt-strike_glassworm_poet-rat_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

advapi32

oleaut32

combase

bcryptprimitives

ws2_32

shell32

ole32

userenv

user32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic