2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom
Size 92.1MB
Sample260815-bfpgtscn6v
SHA256 4fd281c9b5fb0a23a852294ee425bbc5982526ebe23535c38daf221a235296fa
MD5 dbb482c7e939eebf218c32ba59cc4b8e
SHA1 536764ceede7441685d747b2a68d14974c046ac4
SHA512 fe43d301c3b3fee774a887951badfe6915f28ad2968712100a95afb6f4dbb4c3fb4a085ea936cd11a2d51d0467f22ebe7624ca5496c1521b5122c54c0926bbec
SSDEEP 1572864:wU+HdItp6c09ncF1+toZ/DgEyIUeRc74ZLAsRFifTJrKlMlt4hQyC:wn96p6h2+tM/byIZc74J3RFiyMoS
TLSH
T1E3282301BA5A9964D05EC8B4D3474B934F3170DA123AA4FFA1E941283F9B7F05B3E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

File Explorer

2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

.exe 92.1MB

2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

IMPHASH 093a6cd038fd14a54e7d359b46cb8dab
SHA256 4fd281c9b5fb0a23a852294ee425bbc5982526ebe23535c38daf221a235296fa
MD5 dbb482c7e939eebf218c32ba59cc4b8e
SHA1 536764ceede7441685d747b2a68d14974c046ac4
SHA512 fe43d301c3b3fee774a887951badfe6915f28ad2968712100a95afb6f4dbb4c3fb4a085ea936cd11a2d51d0467f22ebe7624ca5496c1521b5122c54c0926bbec
SSDEEP 1572864:wU+HdItp6c09ncF1+toZ/DgEyIUeRc74ZLAsRFifTJrKlMlt4hQyC:wn96p6h2+tM/byIZc74J3RFiyMoS
TLSH
T1E3282301BA5A9964D05EC8B4D3474B934F3170DA123AA4FFA1E941283F9B7F05B3E35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6120512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Updater.pdb

kernel32

SetFileTime GetModuleHandleW VirtualProtect LoadLibraryExA FormatMessageW GetDiskFreeSpaceExW GetLastError GetTickCount64 GetConsoleWindow LoadLibraryA HeapAlloc HeapFree GetProcessHeap FreeConsole GetConsoleMode GetConsoleOutputCP Sleep DeleteFileW SetLastError WriteConsoleW GetModuleFileNameW LoadLibraryExW GetProcAddress CreateDirectoryW GetFullPathNameW FindFirstFileExW CreateFileW HeapReAlloc GetSystemTimePreciseAsFileTime GetTempPathW FindClose GlobalLock SetHandleInformation SetFileInformationByHandle GetFileInformationByHandleEx GetPhysicallyInstalledSystemMemory SetFileCompletionNotificationModes GlobalUnlock GetFileInformationByHandle GetModuleHandleA WriteFileEx ReadFileEx CreateFileMappingW MapViewOfFile CancelIo GetSystemInfo GetOverlappedResult GetStdHandle ReadFile GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW SetFilePointerEx CreateIoCompletionPort FindNextFileW PostQueuedCompletionStatus GlobalSize GlobalAlloc GlobalFree GetSystemTimeAsFileTime FreeLibrary GetQueuedCompletionStatusEx DuplicateHandle SetThreadErrorMode CloseHandle GetFinalPathNameByHandleW UnmapViewOfFile SetUnhandledExceptionFilter InitializeSListHead AddVectoredExceptionHandler GetCurrentProcess SetWaitableTimer CreateWaitableTimerExW Process32Next Process32First CreateToolhelp32Snapshot SwitchToThread GetCurrentThreadId GetCurrentThread WideCharToMultiByte GetUserPreferredUILanguages RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WaitForSingleObject MultiByteToWideChar GetEnvironmentVariableW GetCommandLineW QueryPerformanceFrequency CreateThread SleepEx QueryPerformanceCounter ExitProcess CreateEventW CompareStringOrdinal CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW WaitForMultipleObjects GetExitCodeProcess CreateEventA RemoveVectoredExceptionHandler SetThreadStackGuarantee

advapi32

ImpersonateAnonymousToken RevertToSelf GetTokenInformation RegCloseKey RegEnumKeyExW RegQueryValueExW SystemFunction036 RegOpenKeyExW OpenProcessToken

oleaut32

SysStringLen SysFreeString GetErrorInfo

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile

ws2_32

WSAIoctl WSASocketW ioctlsocket connect getsockopt getsockname WSAGetLastError shutdown bind closesocket getpeername WSAStartup WSACleanup getaddrinfo freeaddrinfo send setsockopt recv WSASend

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateChain CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertEnumCertificatesInStore CertOpenStore CertDuplicateStore

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW ApplyControlToken

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

OpenClipboard GetClipboardData DefWindowProcA RegisterClassExA CreateWindowExA ReleaseDC GetDC DestroyIcon CreateIcon MapVirtualKeyW SetWindowLongW GetCursorPos SendInput CloseClipboard GetWindowLongPtrW DispatchMessageW TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW RegisterRawInputDevices SetWindowLongPtrW ShowWindow MessageBoxW GetSystemMetrics RedrawWindow FlashWindowEx GetClientRect CreateWindowExW RegisterClassExW DestroyWindow MonitorFromPoint ValidateRect SetWindowTextW TrackPopupMenu SetMenuDefaultItem EnableMenuItem PostMessageW GetForegroundWindow GetActiveWindow EmptyClipboard SetWindowPos GetSystemMenu ClientToScreen IsWindowVisible SetClipboardData LoadCursorW SetCursor ReleaseCapture ChangeDisplaySettingsExW GetWindowPlacement SetWindowPlacement GetMonitorInfoW MonitorFromWindow DefWindowProcW GetRawInputData GetWindowLongW GetMenu AdjustWindowRectEx MapVirtualKeyExW GetKeyboardState GetKeyboardLayout ToUnicodeEx TrackMouseEvent ScreenToClient GetTouchInputInfo MonitorFromRect CloseTouchInputHandle GetWindowRect SetCapture SystemParametersInfoA GetClipCursor ClipCursor ShowCursor GetKeyState IsIconic SetForegroundWindow SetWindowDisplayAffinity RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware DestroyCursor RegisterWindowMessageA InvalidateRgn SendMessageW VkKeyScanW

shell32

ShellExecuteW DragQueryFileW DragFinish

gdi32

SelectObject CreateDIBSection SetPixelFormat DeleteDC GetDeviceCaps CreateRectRgn DescribePixelFormat BitBlt GetPixelFormat ChoosePixelFormat SwapBuffers DeleteObject CreateCompatibleDC

opengl32

wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglCreateContext

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

memset memcmp __CxxFrameHandler3 _CxxThrowException __C_specific_handler memcpy __current_exception __current_exception_context memmove

api-ms-win-crt-math-l1-1-0

fmod pow ceil tan round sin cos exp2f exp2 truncf ceilf roundf _hypotf powf tanf fmax fminf acos floor acosf fmaxf fmodf sinf floorf trunc __setusermatherr cosf fmaf atan2

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit strerror _set_app_type _register_thread_local_exe_atexit_callback _crt_atexit __p___argv __p___argc _configure_narrow_argv _exit terminate exit _initterm_e _initterm _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _seh_filter_exe _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom

kernel32

advapi32

oleaut32

ntdll

ws2_32

bcrypt

crypt32

secur32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

shell32

gdi32

opengl32

d3dcompiler_47

ole32

imm32

uxtheme

dwmapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic