2026-08-11_84b13e68d5601b917ab3b07fa766e716_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_84b13e68d5601b917ab3b07fa766e716_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 45.2MB
Sample260811-dcf3dsca83
SHA256 fcbeb6145d6d3bdc382c2b434b898a994f3a6f0052520c84d9c6081e80a90c71
MD5 84b13e68d5601b917ab3b07fa766e716
SHA1 27d4eda5e052d065fb24e0aa113b6e26f978fc77
SHA512 05664862520783828f67472e8461219ae2ae476aab0818ba9139e0abbf1815c1f3876c7bd2a8bf9423c5af1430e6988662c6f3650b4aeb5a862b5c123f8f47f4
SSDEEP 393216:1sTLqLBz1GgJgXhF1HaV/V3HBFkm4QokPOr0GJH3hC8oxv:nLnGgJgRbHaV/V3heFQokPOr08C8oxv
TLSH
T156A709057B9F99A9D19AC874C30A8A635F2130DB162AB8BF40C856353FBDBB45B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_84b13e68d5601b917ab3b07fa766e716_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-11_84b13e68d5601b917ab3b07fa766e716_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 45.2MB

2026-08-11_84b13e68d5601b917ab3b07fa766e716_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 0a68b3feb53759089291ed935429ebaf
SHA256 fcbeb6145d6d3bdc382c2b434b898a994f3a6f0052520c84d9c6081e80a90c71
MD5 84b13e68d5601b917ab3b07fa766e716
SHA1 27d4eda5e052d065fb24e0aa113b6e26f978fc77
SHA512 05664862520783828f67472e8461219ae2ae476aab0818ba9139e0abbf1815c1f3876c7bd2a8bf9423c5af1430e6988662c6f3650b4aeb5a862b5c123f8f47f4
SSDEEP 393216:1sTLqLBz1GgJgXhF1HaV/V3HBFkm4QokPOr0GJH3hC8oxv:nLnGgJgRbHaV/V3heFQokPOr08C8oxv
TLSH
T156A709057B9F99A9D19AC874C30A8A635F2130DB162AB8BF40C856353FBDBB45B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36226048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agent_doc.pdb

kernel32

SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW ReadConsoleW CreateDirectoryW ExitProcess WaitForMultipleObjects GetOverlappedResult CreateEventW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW WaitNamedPipeW GetTempPathW DeleteFileW GetFinalPathNameByHandleW CopyFileExW LocalAlloc CreateSymbolicLinkW LocalFree FreeLibrary WriteFile ReadFile SetHandleInformation ConnectNamedPipe GetNamedPipeInfo UnlockFile GetFileType SetConsoleTextAttribute CancelIo GetConsoleScreenBufferInfo SetConsoleMode SetFileTime MapViewOfFile CreateFileMappingW FormatMessageA SetNamedPipeHandleState GetSystemTimeAsFileTime GetFileSize HeapDestroy HeapCompact GetSystemInfo GetNativeSystemInfo DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW FormatMessageW HeapAlloc GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException GetConsoleMode GetProcessId CreatePipe GetFullPathNameW GetTickCount FlushFileBuffers QueryPerformanceFrequency QueryPerformanceCounter SetEnvironmentVariableW AddVectoredExceptionHandler GetEnvironmentStringsW FreeEnvironmentStringsW ExpandEnvironmentStringsW SetLastError GetSystemTime RtlCaptureContext RtlVirtualUnwind GetCurrentDirectoryW lstrlenW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW CompareStringOrdinal GetCommandLineW SetCurrentDirectoryW SystemTimeToFileTime InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CreateNamedPipeW LockFileEx DuplicateHandle GetCurrentProcess ReadFileEx GetCurrentThread SetThreadStackGuarantee WriteFileEx SleepEx FindNextFileW DeviceIoControl OpenProcess GetStdHandle GetExitCodeProcess SetFileAttributesW SetWaitableTimer WriteConsoleW CreateWaitableTimerExW GetCurrentProcessId CreateThread CreateSemaphoreW SetErrorMode GetModuleHandleW WaitForSingleObject SwitchToThread UnlockFileEx WaitForSingleObjectEx GetConsoleOutputCP DisconnectNamedPipe FindClose HeapReAlloc SetFilePointerEx ReleaseMutex CreateMutexA GetSystemTimePreciseAsFileTime LoadLibraryA RtlLookupFunctionEntry LoadLibraryW TerminateProcess CreateProcessW HeapFree DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList ReleaseSemaphore GetProcessHeap GetCurrentThreadId SetEndOfFile ReadDirectoryChangesW InitializeSListHead GetProcAddress GetModuleHandleA Sleep CloseHandle MoveFileExW GetLastError SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ws2_32

bind WSADuplicateSocketW accept freeaddrinfo getaddrinfo getsockname ioctlsocket setsockopt WSASocketW WSACleanup WSAStartup select listen send recv getsockopt closesocket WSAGetLastError shutdown connect getpeername

advapi32

SetSecurityDescriptorGroup FreeSid IsValidSid GetSidSubAuthorityCount GetAclInformation RegEnumValueW GetSidLengthRequired SystemFunction036 CopySid GetSecurityDescriptorGroup InitializeAcl GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetAce SetSecurityDescriptorOwner AddAce RegOpenKeyExW GetSecurityDescriptorControl SetSecurityDescriptorControl GetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorSacl RegCloseKey GetSecurityDescriptorOwner

ntdll

NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile NtReadFile NtOpenFile

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

vcruntime140

strrchr memcmp memmove memset _CxxThrowException strchr __C_specific_handler memchr __current_exception __current_exception_context memcpy __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

towlower strncmp strcmp strspn strcspn iswctype strlen isdigit

api-ms-win-crt-math-l1-1-0

fmod pow ceilf log _fdopen __setusermatherr log10f

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode calloc free _msize realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc exit _get_initial_narrow_environment _initterm_e _beginthreadex _endthreadex _wassert abort _seh_filter_exe _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _configure_narrow_argv terminate _initialize_narrow_environment _exit _initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fputs fputc fclose __acrt_iob_func __stdio_common_vsprintf _set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_84b13e68d5601b917ab3b07fa766e716_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

advapi32

ntdll

bcryptprimitives

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic