Extracted

• • Target
    2026-08-13_3ca732d9cfbbffbd967c75f1ea6ceee7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 14.2MB
  • SHA256 706dd1fb46dd63704238a8187864ab915cb1bb28fe3e5350e21a4c9a41182746
  • MD5 3ca732d9cfbbffbd967c75f1ea6ceee7
  • SHA1 e3aa9d032df1c3487a2a00cd1bc9c8082cc66e19
  • SHA512 1864a62d0b4a22e406fa34b2385f8d80b0eff6a723f1d7da40399e01511f207f2e5b679d43629eb083208b8aa8c29dbda37419fe0d9a83ba0230be5a5d705470
  • SSDEEP 196608:TUgIRP7e9wRKzrhYEqjaY/4AQB7Osu/G+XoFc:TORDNEqm0496sBSoFc
  • TLSH
    T12FE629257B9A99ACD05BC47482474A625E7170CB0B39B9FF449492383F7ABF42F38319
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  f139972a13ea65d5e96996c8b4114c3cdefense_evasiondiscoveryvidarstealertrojancredential_accessspyware

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Detects executables containing URLs to raw contents of a Github gist

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2