2026-08-11_9a91c94fb0b9bc56f7298dd5fd68f930_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_9a91c94fb0b9bc56f7298dd5fd68f930_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 7.4MB
Sample260811-c66dpstfkb
SHA256 d395667d29a517b5284f522ed9b74cb48709ba8eaa90d9a600d75c47d632475a
MD5 9a91c94fb0b9bc56f7298dd5fd68f930
SHA1 29f810ff68e2fd0de038e101a304322c5c658b75
SHA512 f7ab8db2b5ca0d402bbe83e3a1178da8d001528e46c3c367573031c637cd98248672730656f1be336d49e1ec010e548af5d6242c4e1f422808b4188d3c0cab29
SSDEEP 98304:q0mY0rGsaMz8lXXRbkyZNW481bu5L3K+XJgYQ:94DzglXXtTWCJ
TLSH
T1FD765A12BA6A59ACD15BC07483464673AA7130DB0B35B9FF44C496393F6AEF11F3C268
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_9a91c94fb0b9bc56f7298dd5fd68f930_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-11_9a91c94fb0b9bc56f7298dd5fd68f930_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 7.4MB

2026-08-11_9a91c94fb0b9bc56f7298dd5fd68f930_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 6422fdc4ab8fd5a705d707cf53950cab
SHA256 d395667d29a517b5284f522ed9b74cb48709ba8eaa90d9a600d75c47d632475a
MD5 9a91c94fb0b9bc56f7298dd5fd68f930
SHA1 29f810ff68e2fd0de038e101a304322c5c658b75
SHA512 f7ab8db2b5ca0d402bbe83e3a1178da8d001528e46c3c367573031c637cd98248672730656f1be336d49e1ec010e548af5d6242c4e1f422808b4188d3c0cab29
SSDEEP 98304:q0mY0rGsaMz8lXXRbkyZNW481bu5L3K+XJgYQ:94DzglXXtTWCJ
TLSH
T1FD765A12BA6A59ACD15BC07483464673AA7130DB0B35B9FF44C496393F6AEF11F3C268
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5222192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

jewish.pdb

user32

GetSystemMetrics GetWindowTextA FindWindowA GetForegroundWindow

kernel32

SetUnhandledExceptionFilter CloseHandle GetTickCount GetComputerNameA LoadLibraryExW GetLastError GetProcAddress InitializeSListHead DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapDestroy AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId UnlockFile SetLastError LocalFree SetFileInformationByHandle SetFileTime QueryPerformanceFrequency CreateThread LockFileEx GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetFileSize GetSystemInfo GetFileInformationByHandleEx GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCurrentProcessId lstrlenW GetProcessHeap CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread CreateMutexA ReleaseMutex GetFinalPathNameByHandleW SystemTimeToFileTime SetEnvironmentVariableW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetModuleHandleW WideCharToMultiByte GetSystemTimeAsFileTime GetModuleHandleA GetSystemTime FindNextFileW FormatMessageA LoadLibraryW CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers HeapAlloc RtlVirtualUnwind HeapReAlloc GetFileInformationByHandle WriteFile ReadFile GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation HeapCompact GetModuleFileNameW SetThreadErrorMode HeapCreate FreeLibrary

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExW SystemFunction036 RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

WSAGetLastError WSACleanup freeaddrinfo closesocket WSAStartup WSAIoctl setsockopt getpeername shutdown bind WSASocketW send recv getsockopt connect ioctlsocket WSASend getsockname getaddrinfo

ntdll

NtCancelIoFileEx NtCreateFile NtReadFile NtOpenFile RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

vcruntime140

__current_exception _CxxThrowException strrchr __C_specific_handler memmove __current_exception_context memcmp __CxxFrameHandler3 memcpy memset

api-ms-win-crt-string-l1-1-0

strlen strcspn strcmp strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr log pow

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _msize realloc malloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_exit _configure_narrow_argv _set_app_type __p___argc _seh_filter_exe __p___argv _cexit _c_exit _initterm_e _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _endthreadex _initialize_onexit_table _register_onexit_function _crt_atexit terminate _beginthreadex exit _initialize_narrow_environment

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_9a91c94fb0b9bc56f7298dd5fd68f930_akira_cobalt-strike_glassworm_rusty-stealer_satacom

user32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcryptprimitives

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic