General
- Target 2026-08-09_83f1710e51237b5ce4f722c1eb203bbf_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 8.6MB
- Sample260809-epfg3atvby
- SHA256 f57423142ee14a4698ab81667a7531625a8c81bb841d7419e0f6afde7ed457d1
- MD5 83f1710e51237b5ce4f722c1eb203bbf
- SHA1 3d32a8de1d3ada33c9680ba3b97545243e3acd83
- SHA512 39bd60dd7a3e22fb8a96e6ba16db2bcbe9f7dd0f130638cae93df5f85956d0c3e70a22c8a9147de0a1c6433116f767a678d9bc0d01217f6d7f06e4ce236e8fb8
- SSDEEP 98304:epkywzKcUE0Nu87nkrDGzvwR8GYkLSrzfiVHop7+dcsfY:3dAFIckrDGnaHoRicgY
- TLSH T151965A12BB5A55ECD19AC47483464673AA7170CB0B35BAFF448486393F6AAF11F3C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-09_83f1710e51237b5ce4f722c1eb203bbf_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_83f1710e51237b5ce4f722c1eb203bbf_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_83f1710e51237b5ce4f722c1eb203bbf_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 8.6MB
- SHA256 f57423142ee14a4698ab81667a7531625a8c81bb841d7419e0f6afde7ed457d1
- MD5 83f1710e51237b5ce4f722c1eb203bbf
- SHA1 3d32a8de1d3ada33c9680ba3b97545243e3acd83
- SHA512 39bd60dd7a3e22fb8a96e6ba16db2bcbe9f7dd0f130638cae93df5f85956d0c3e70a22c8a9147de0a1c6433116f767a678d9bc0d01217f6d7f06e4ce236e8fb8
- SSDEEP 98304:epkywzKcUE0Nu87nkrDGzvwR8GYkLSrzfiVHop7+dcsfY:3dAFIckrDGnaHoRicgY
- TLSH T151965A12BB5A55ECD19AC47483464673AA7170CB0B35BAFF448486393F6AAF11F3C368
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Looks for VirtualBox drivers on disk
-
Looks for VMWare drivers on disk
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.