2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 10.5MB
Sample260813-grfxqatalg
SHA256 eec29a29473707d2e7ee84c8cdd53e6501a83b95521a6f9f1d2828e5e70563e8
MD5 c58bd4daacc83720f956858e027518fd
SHA1 e7f402915666073c605de7b19f10187f044451e7
SHA512 edf2a0e2b10bc1efdbc8c8a6812dfaa8543a61efa0ddd38f7d99622c2281a3025a9fac2162d8ec36e2d4f9eb78a470e71175f5edc040671ce57318cab142d053
SSDEEP 98304:h+Ll9PDx5zx21C3/FRSpNsQWOvVIMIuCQOe/EpyMM3GtEXENPAMxm+1Gh5hQCDRC:29PvxgCIWOvjIppZM2W4AMhMXeWE
TLSH
T13CB64C03F66290E8C06AC575835AE633FB32B88D493472BF6BA45B312E65F506F1D748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

File Explorer

2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 10.5MB

2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 26a56da1a195666d8a92f6140405d00f
SHA256 eec29a29473707d2e7ee84c8cdd53e6501a83b95521a6f9f1d2828e5e70563e8
MD5 c58bd4daacc83720f956858e027518fd
SHA1 e7f402915666073c605de7b19f10187f044451e7
SHA512 edf2a0e2b10bc1efdbc8c8a6812dfaa8543a61efa0ddd38f7d99622c2281a3025a9fac2162d8ec36e2d4f9eb78a470e71175f5edc040671ce57318cab142d053
SSDEEP 98304:h+Ll9PDx5zx21C3/FRSpNsQWOvVIMIuCQOe/EpyMM3GtEXENPAMxm+1Gh5hQCDRC:29PvxgCIWOvjIppZM2W4AMhMXeWE
TLSH
T13CB64C03F66290E8C06AC575835AE633FB32B88D493472BF6BA45B312E65F506F1D748
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Digest

8d:69:8a:b0:dc:01:77:5b:d5:6f:63:d3:1b:b6:46:1e:27:19:60:51:cb:c4:60:6f:1c:b3:ad:cb:ba:26:42:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Chains

Aug 9, 2026

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Serial Number

18:e3:9e:88:96:d2:39:fa:85:00:f1:72:0b:63:eb:ad

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 18, 2026 - Jun 18, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

7952400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

redbooster.pdb

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile RtlGetVersion NtReadFile NtWriteFile RtlNtStatusToDosError NtQueryTimerResolution NtSetTimerResolution NtDeviceIoControlFile NtSetSystemInformation NtQuerySystemInformation NtCreateNamedPipeFile NtCancelIoFileEx NtQueryInformationProcess

kernel32

HeapReAlloc GetProcessId WaitForSingleObject GetExitCodeProcess GetCurrentProcessId LCIDToLocaleName AcquireSRWLockExclusive SetFilePointerEx HeapFree WakeAllConditionVariable SleepConditionVariableSRW RemoveDirectoryW FlushFileBuffers GetCurrentProcess lstrlenW GetSystemTimeAsFileTime SetLastError GetProcessHeap QueryFullProcessImageNameW SetProcessWorkingSetSize OpenProcess GetCurrentThread SetThreadStackGuarantee GetFinalPathNameByHandleW SwitchToThread FreeLibrary SetEvent GetTickCount64 ReleaseMutex RtlPcToFileHeader LoadLibraryExA FindClose RtlLookupFunctionEntry WaitForSingleObjectEx WideCharToMultiByte MultiByteToWideChar HeapAlloc SleepEx FormatMessageW ReleaseSRWLockExclusive SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess TerminateProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetTempPathW DeleteFileW CopyFileExW MoveFileExW SetWaitableTimer FindNextFileW GetDriveTypeW GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetDiskFreeSpaceExW GetProcessTimes GetSystemTimes GetProcessIoCounters ReadProcessMemory VirtualQueryEx RaiseException LocalFree GlobalMemoryStatusEx FindFirstVolumeW FindNextVolumeW FindVolumeClose FlsAlloc GetComputerNameExW FlsGetValue FlsSetValue FlsFree EncodePointer LoadLibraryA GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle SetHandleInformation GetQueuedCompletionStatusEx GetCurrentThreadId LoadLibraryExW OutputDebugStringA CreatePipe DeviceIoControl GetUserDefaultUILanguage LoadLibraryW GetFullPathNameW CreateFileW GetSystemInfo CreateIoCompletionPort PostQueuedCompletionStatus CreateEventW GetModuleHandleW CreateWaitableTimerExW ReadFile CreateProcessW CreateDirectoryW CancelIo CreateThread WriteFileEx ReadFileEx WriteConsoleW GetOverlappedResult GetConsoleOutputCP GetSystemTimePreciseAsFileTime WriteFile GetConsoleMode GetStdHandle CreateMutexA CreateMutexW OutputDebugStringW InitializeSListHead InitializeCriticalSectionEx SetUnhandledExceptionFilter RtlUnwindEx K32GetPerformanceInfo GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW AddVectoredExceptionHandler SetEnvironmentVariableW CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlVirtualUnwind RtlCaptureContext DeleteCriticalSection

shell32

SHGetKnownFolderPath DragQueryFileW DragFinish SHCreateItemFromParsingName Shell_NotifyIconW CommandLineToArgvW SHAppBarMessage ShellExecuteExW ILCreateFromPathW SHOpenFolderAndSelectItems ILFree Shell_NotifyIconGetRect ShellExecuteW

ole32

CoTaskMemAlloc CoUninitialize CoIncrementMTAUsage CoCreateFreeThreadedMarshaler RevokeDragDrop CoCreateInstance CoTaskMemFree CoInitialize CoInitializeEx RegisterDragDrop OleInitialize

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

gdi32

SetTextColor SelectObject CombineRgn DeleteDC BitBlt CreateDIBSection CreateSolidBrush SetBkMode CreateRectRgn DeleteObject CreateCompatibleDC StretchBlt SetStretchBltMode CreateFontW Ellipse GetStockObject CreatePen GetDeviceCaps

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass TaskDialogIndirect

user32

MapVirtualKeyW GetAsyncKeyState SetCursorPos SetCursor FlashWindowEx RegisterTouchWindow IsWindow IsWindowEnabled IsIconic IsWindowVisible MsgWaitForMultipleObjectsEx TranslateAcceleratorW SetLayeredWindowAttributes GetSystemMetrics EnableWindow SetPropW EnumChildWindows GetKeyboardState SetWindowTextW GetWindowTextW LoadCursorW UpdateWindow RegisterClassExW GetWindowTextLengthW SetWindowDisplayAffinity GetWindowLongPtrW MonitorFromRect ToUnicodeEx InvalidateRect GetRawInputData RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint MapVirtualKeyExW GetUpdateRect ScreenToClient SetCapture GetKeyboardLayout ClipCursor GetTouchInputInfo GetClipCursor ShowCursor IsProcessDPIAware MonitorFromWindow CloseTouchInputHandle SetWindowLongW GetSystemMenu GetMonitorInfoW DestroyIcon GetWindowPlacement TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem SetWindowPlacement CreateWindowExW SetParent SetWindowPos PostThreadMessageW ChangeWindowMessageFilterEx RegisterClassW TrackMouseEvent SetWindowLongPtrW DispatchMessageW FindWindowExW GetParent SetWindowRgn KillTimer SetTimer TranslateMessage GetKeyState RegisterRawInputDevices DrawIconEx AdjustWindowRectEx GetMenu GetDC GetWindowLongW VkKeyScanW AppendMenuW InsertMenuW InvalidateRgn SendInput CheckMenuItem DrawTextW ReleaseCapture DispatchMessageA ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA PostMessageW GetActiveWindow GetMessageW SetMenu RegisterWindowMessageA RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyMenu GetWindow SetFocus FindWindowW PeekMessageW DestroyWindow EnumDisplayDevicesW ChangeDisplaySettingsExW EnumDisplaySettingsW MoveWindow GetMessageA RegisterHotKey UnregisterHotKey ValidateRect GetWindowThreadProcessId GetForegroundWindow EndPaint BeginPaint DefWindowProcW SystemParametersInfoW

advapi32

CopySid GetLengthSid IsValidSid RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegEnumKeyExW GetTokenInformation RegGetValueW RegCloseKey RegEnumValueW RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegDeleteValueW EventRegister EventSetInformation EventWriteTransfer EventUnregister RegCreateKeyExW

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

shlwapi

SHCreateMemStream

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

hid

HidD_FreePreparsedData HidP_GetCaps HidD_GetPreparsedData HidD_GetAttributes HidD_GetHidGuid HidD_SetOutputReport

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoInitialize

ws2_32

getaddrinfo getsockopt WSASocketW WSACleanup WSAStartup send recv freeaddrinfo accept listen bind select ioctlsocket closesocket WSAGetLastError connect setsockopt

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

psapi

GetModuleFileNameExW

pdh

PdhCloseQuery PdhAddEnglishCounterW PdhOpenQueryA PdhGetFormattedCounterValue PdhCollectQueryData PdhRemoveCounter

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

log2 trunc fmod sin __setusermatherr roundf round pow floor

api-ms-win-crt-string-l1-1-0

wcscmp wcslen strlen strcpy_s _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate __p___argc _exit exit abort _initterm_e _initterm _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment __p___argv _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_c58bd4daacc83720f956858e027518fd_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

ntdll

kernel32

shell32

ole32

api-ms-win-core-synch-l1-2-0

gdi32

comctl32

user32

advapi32

oleaut32

shlwapi

dwmapi

hid

api-ms-win-core-winrt-l1-1-0

ws2_32

setupapi

psapi

pdh

powrprof

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic