2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 10.5MB
Sample260809-tbf9rs1djd
SHA256 9c6827030e1af86c304a8ce08b8fd803ff3a33775f29eec77f7633b5e99f8112
MD5 dce77eeca7959c65260ddd705f505ceb
SHA1 9755cae0035658fb0952c28a75b53cef6bb017a2
SHA512 a3390a4cb198df98330fc0fbe3c3c2e52b540d809e9ebe845a6e727de057459facadeb921b8494dc1d1ebeafa7bcfa7260312df04d7fffccbe4b06347d7d57be
SSDEEP 98304:T0amP3op3n+S8/pfUXR96QhGighKUZvYhGk7u0eYoKb+f28ujaBclGfGRnADrgRF:sPw3n+S8mhGigY7JXZ028ujfRMX0/
TLSH
T12DB64D03F66280E8C06AC5B5835AE633FB32B88D493472BF5BA45B312E65F506F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

File Explorer

2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 10.5MB

2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 26a56da1a195666d8a92f6140405d00f
SHA256 9c6827030e1af86c304a8ce08b8fd803ff3a33775f29eec77f7633b5e99f8112
MD5 dce77eeca7959c65260ddd705f505ceb
SHA1 9755cae0035658fb0952c28a75b53cef6bb017a2
SHA512 a3390a4cb198df98330fc0fbe3c3c2e52b540d809e9ebe845a6e727de057459facadeb921b8494dc1d1ebeafa7bcfa7260312df04d7fffccbe4b06347d7d57be
SSDEEP 98304:T0amP3op3n+S8/pfUXR96QhGighKUZvYhGk7u0eYoKb+f28ujaBclGfGRnADrgRF:sPw3n+S8mhGigY7JXZ028ujfRMX0/
TLSH
T12DB64D03F66280E8C06AC5B5835AE633FB32B88D493472BF5BA45B312E65F506F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Digest

b3:ee:12:3d:49:26:8b:df:20:f0:12:8b:f1:a4:61:30:49:48:14:7c:a0:14:12:ce:25:7d:4f:ec:cf:a0:43:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Chains

Aug 7, 2026

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Serial Number

18:e3:9e:88:96:d2:39:fa:85:00:f1:72:0b:63:eb:ad

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 18, 2026 - Jun 18, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

7948848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

redbooster.pdb

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile RtlGetVersion NtReadFile NtWriteFile RtlNtStatusToDosError NtQueryTimerResolution NtSetTimerResolution NtDeviceIoControlFile NtSetSystemInformation NtQuerySystemInformation NtCreateNamedPipeFile NtCancelIoFileEx NtQueryInformationProcess

kernel32

HeapReAlloc GetProcessId WaitForSingleObject GetExitCodeProcess GetCurrentProcessId LCIDToLocaleName AcquireSRWLockExclusive SetFilePointerEx HeapFree WakeAllConditionVariable SleepConditionVariableSRW RemoveDirectoryW FlushFileBuffers GetCurrentProcess lstrlenW GetSystemTimeAsFileTime SetLastError GetProcessHeap QueryFullProcessImageNameW SetProcessWorkingSetSize OpenProcess GetCurrentThread SetThreadStackGuarantee GetFinalPathNameByHandleW SwitchToThread FreeLibrary SetEvent GetTickCount64 ReleaseMutex RtlPcToFileHeader LoadLibraryExA FindClose RtlLookupFunctionEntry WaitForSingleObjectEx WideCharToMultiByte MultiByteToWideChar HeapAlloc SleepEx FormatMessageW ReleaseSRWLockExclusive SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess TerminateProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetTempPathW DeleteFileW CopyFileExW MoveFileExW SetWaitableTimer FindNextFileW GetDriveTypeW GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetDiskFreeSpaceExW GetProcessTimes GetSystemTimes GetProcessIoCounters ReadProcessMemory VirtualQueryEx RaiseException LocalFree GlobalMemoryStatusEx FindFirstVolumeW FindNextVolumeW FindVolumeClose FlsAlloc GetComputerNameExW FlsGetValue FlsSetValue FlsFree EncodePointer LoadLibraryA GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle SetHandleInformation GetQueuedCompletionStatusEx GetCurrentThreadId LoadLibraryExW OutputDebugStringA CreatePipe DeviceIoControl GetUserDefaultUILanguage LoadLibraryW GetFullPathNameW CreateFileW GetSystemInfo CreateIoCompletionPort PostQueuedCompletionStatus CreateEventW GetModuleHandleW CreateWaitableTimerExW ReadFile CreateProcessW CreateDirectoryW CancelIo CreateThread WriteFileEx ReadFileEx WriteConsoleW GetOverlappedResult GetConsoleOutputCP GetSystemTimePreciseAsFileTime WriteFile GetConsoleMode GetStdHandle CreateMutexA CreateMutexW OutputDebugStringW InitializeSListHead InitializeCriticalSectionEx SetUnhandledExceptionFilter RtlUnwindEx K32GetPerformanceInfo GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW AddVectoredExceptionHandler SetEnvironmentVariableW CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlVirtualUnwind RtlCaptureContext DeleteCriticalSection

shell32

SHGetKnownFolderPath DragQueryFileW DragFinish SHCreateItemFromParsingName Shell_NotifyIconW CommandLineToArgvW SHAppBarMessage ShellExecuteExW ILCreateFromPathW SHOpenFolderAndSelectItems ILFree Shell_NotifyIconGetRect ShellExecuteW

ole32

CoTaskMemAlloc CoUninitialize CoIncrementMTAUsage CoCreateFreeThreadedMarshaler RevokeDragDrop CoCreateInstance CoTaskMemFree CoInitialize CoInitializeEx RegisterDragDrop OleInitialize

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

gdi32

SetTextColor SelectObject CombineRgn DeleteDC BitBlt CreateDIBSection CreateSolidBrush SetBkMode CreateRectRgn DeleteObject CreateCompatibleDC StretchBlt SetStretchBltMode CreateFontW Ellipse GetStockObject CreatePen GetDeviceCaps

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass TaskDialogIndirect

user32

MapVirtualKeyW GetAsyncKeyState SetCursorPos SetCursor FlashWindowEx RegisterTouchWindow IsWindow IsWindowEnabled IsIconic IsWindowVisible MsgWaitForMultipleObjectsEx TranslateAcceleratorW SetLayeredWindowAttributes GetSystemMetrics EnableWindow SetPropW EnumChildWindows GetKeyboardState SetWindowTextW GetWindowTextW LoadCursorW UpdateWindow RegisterClassExW GetWindowTextLengthW SetWindowDisplayAffinity GetWindowLongPtrW MonitorFromRect ToUnicodeEx InvalidateRect GetRawInputData RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint MapVirtualKeyExW GetUpdateRect ScreenToClient SetCapture GetKeyboardLayout ClipCursor GetTouchInputInfo GetClipCursor ShowCursor IsProcessDPIAware MonitorFromWindow CloseTouchInputHandle SetWindowLongW GetSystemMenu GetMonitorInfoW DestroyIcon GetWindowPlacement TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem SetWindowPlacement CreateWindowExW SetParent SetWindowPos PostThreadMessageW ChangeWindowMessageFilterEx RegisterClassW TrackMouseEvent SetWindowLongPtrW DispatchMessageW FindWindowExW GetParent SetWindowRgn KillTimer SetTimer TranslateMessage GetKeyState RegisterRawInputDevices DrawIconEx AdjustWindowRectEx GetMenu GetDC GetWindowLongW VkKeyScanW AppendMenuW InsertMenuW InvalidateRgn SendInput CheckMenuItem DrawTextW ReleaseCapture DispatchMessageA ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA PostMessageW GetActiveWindow GetMessageW SetMenu RegisterWindowMessageA RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyMenu GetWindow SetFocus FindWindowW PeekMessageW DestroyWindow EnumDisplayDevicesW ChangeDisplaySettingsExW EnumDisplaySettingsW MoveWindow GetMessageA RegisterHotKey UnregisterHotKey ValidateRect GetWindowThreadProcessId GetForegroundWindow EndPaint BeginPaint DefWindowProcW SystemParametersInfoW

advapi32

CopySid GetLengthSid IsValidSid RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegEnumKeyExW GetTokenInformation RegGetValueW RegCloseKey RegEnumValueW RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegDeleteValueW EventRegister EventSetInformation EventWriteTransfer EventUnregister RegCreateKeyExW

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

shlwapi

SHCreateMemStream

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

hid

HidD_FreePreparsedData HidP_GetCaps HidD_GetPreparsedData HidD_GetAttributes HidD_GetHidGuid HidD_SetOutputReport

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

ws2_32

getaddrinfo getsockopt WSASocketW WSACleanup WSAStartup send recv freeaddrinfo accept listen bind select ioctlsocket closesocket WSAGetLastError connect setsockopt

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

psapi

GetModuleFileNameExW

pdh

PdhCloseQuery PdhAddEnglishCounterW PdhOpenQueryA PdhGetFormattedCounterValue PdhCollectQueryData PdhRemoveCounter

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

log2 trunc fmod sin __setusermatherr roundf round pow floor

api-ms-win-crt-string-l1-1-0

wcscmp wcslen strlen strcpy_s _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate __p___argc _exit exit abort _initterm_e _initterm _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment __p___argv _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_dce77eeca7959c65260ddd705f505ceb_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

ntdll

kernel32

shell32

ole32

api-ms-win-core-synch-l1-2-0

gdi32

comctl32

user32

advapi32

oleaut32

shlwapi

dwmapi

hid

api-ms-win-core-winrt-l1-1-0

ws2_32

setupapi

psapi

pdh

powrprof

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic