2026-08-14_eb393344b25a505e44cc609f59042c66_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_eb393344b25a505e44cc609f59042c66_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Size 27.0MB
Sample260814-pda4batsev
SHA256 4f162eff0e31c17ea51176b8c1e33bbdaa32e5cf9f962628d7a8b6bb6067dd52
MD5 eb393344b25a505e44cc609f59042c66
SHA1 4775ee1dc48ead7c56abe84db8dff82061818f14
SHA512 8ce1a8a37748cb41da3bd79dbad82f7e672ad9c0e0425e90ed08be520e6b7beee446a3b4df5c34e5f1a974b7f76666207e90c175c72adbc32c898dcdfcb05efa
SSDEEP 393216:4vqIcJHxz85u2HMNzDLqeibDOsECWKR0zKSquyfaOs9Iu:z2HPbIOs
TLSH
T1445719117A5FA8ADD19ACC74834A4A734E2030EB1A36BDBF54C885353F6DBB45B2D318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_eb393344b25a505e44cc609f59042c66_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

File Explorer

2026-08-14_eb393344b25a505e44cc609f59042c66_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

.exe 27.0MB

2026-08-14_eb393344b25a505e44cc609f59042c66_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

IMPHASH 81996397eaafa3d6fbbe541dbb23f89b
SHA256 4f162eff0e31c17ea51176b8c1e33bbdaa32e5cf9f962628d7a8b6bb6067dd52
MD5 eb393344b25a505e44cc609f59042c66
SHA1 4775ee1dc48ead7c56abe84db8dff82061818f14
SHA512 8ce1a8a37748cb41da3bd79dbad82f7e672ad9c0e0425e90ed08be520e6b7beee446a3b4df5c34e5f1a974b7f76666207e90c175c72adbc32c898dcdfcb05efa
SSDEEP 393216:4vqIcJHxz85u2HMNzDLqeibDOsECWKR0zKSquyfaOs9Iu:z2HPbIOs
TLSH
T1445719117A5FA8ADD19ACC74834A4A734E2030EB1A36BDBF54C885353F6DBB45B2D318
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21565728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tombi.pdb

kernel32

GetProcAddress GetModuleHandleA SetLastError LoadLibraryA WideCharToMultiByte MultiByteToWideChar HeapAlloc GetModuleHandleW SetHandleInformation FlushFileBuffers GetModuleFileNameW lstrlenW GetLastError GetSystemInfo HeapReAlloc SetStdHandle GetTimeZoneInformationForYear GetSystemTimePreciseAsFileTime CloseHandle HeapFree GetProcessHeap GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute Sleep FindClose SwitchToThread SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA TerminateProcess CreateThread WaitForSingleObject CreateWaitableTimerExW SetWaitableTimer QueryPerformanceCounter QueryPerformanceFrequency GetFileInformationByHandle WriteFile GetQueuedCompletionStatusEx DeleteCriticalSection InitializeCriticalSectionEx CreateIoCompletionPort SetFileCompletionNotificationModes GetFinalPathNameByHandleW LeaveCriticalSection EnterCriticalSection EncodePointer PostQueuedCompletionStatus GetCurrentThreadId RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind GetCurrentDirectoryW GetConsoleOutputCP FlsFree WriteConsoleW GetEnvironmentVariableW FormatMessageW FlsSetValue FlsGetValue GetCurrentThread SetThreadStackGuarantee GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandleEx FlsAlloc ReadConsoleW CreateDirectoryW ExitProcess GetFileType RaiseException SetFilePointerEx FindNextFileW RtlPcToFileHeader RtlUnwindEx GetStartupInfoW GetCommandLineW AddVectoredExceptionHandler SetUnhandledExceptionFilter GetSystemTimeAsFileTime FreeLibrary GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW HeapSize InitializeSListHead

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtOpenFile NtReadFile NtWriteFile

bcryptprimitives

ProcessPrng

crypt32

CertVerifyTimeValidity CertCloseStore CertOpenStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertGetEnhancedKeyUsage CertFreeCertificateContext

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

getaddrinfo freeaddrinfo recv closesocket bind WSAIoctl getsockopt ioctlsocket WSASocketW getsockname WSAGetLastError getpeername connect shutdown WSACleanup send setsockopt WSASend WSAStartup

Name

.text

Size

20.9MB

Virtual Size

20.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

863KB

Virtual Size

863KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_eb393344b25a505e44cc609f59042c66_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom

kernel32

shell32

combase

ntdll

bcryptprimitives

crypt32

bcrypt

advapi32

userenv

api-ms-win-core-synch-l1-2-0

ws2_32

generic