815ffeb3c94fb1c37d2669341fd9fba09685ad95f7c942a50fbd6e3b24320a18

General

Target
2026-08-17_3ec0140f89258d7cb7f3d97f30c89a83_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 5.3MB
Sample260818-avjdpabq61
SHA256 815ffeb3c94fb1c37d2669341fd9fba09685ad95f7c942a50fbd6e3b24320a18
MD5 3ec0140f89258d7cb7f3d97f30c89a83
SHA1 e68f6c560615505ecf8516773695b05d9996fbd4
SHA512 82517ddbd9cdd9d9961c9340f968c5dc76cc51ec0490aff2d2bec4271363feb7e9eef91dc501ea2d03e0af0f5fbaf79d8c1f07e04765b3581bea4d95798c2d03
SSDEEP 98304:AWy5/Pk3jwElfxaoTrEGNtAcPsutMp3+:wM0ElfxaoUg30uiV
TLSH
T152468C03F78681EDC09EC0B883479636EB76F8860A24A7DF56D45A212F63F611F5D398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_3ec0140f89258d7cb7f3d97f30c89a83_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 5.3MB
- SHA256 815ffeb3c94fb1c37d2669341fd9fba09685ad95f7c942a50fbd6e3b24320a18
- MD5 3ec0140f89258d7cb7f3d97f30c89a83
- SHA1 e68f6c560615505ecf8516773695b05d9996fbd4
- SHA512 82517ddbd9cdd9d9961c9340f968c5dc76cc51ec0490aff2d2bec4271363feb7e9eef91dc501ea2d03e0af0f5fbaf79d8c1f07e04765b3581bea4d95798c2d03
- SSDEEP 98304:AWy5/Pk3jwElfxaoTrEGNtAcPsutMp3+:wM0ElfxaoUg30uiV
- TLSH
  T152468C03F78681EDC09EC0B883479636EB76F8860A24A7DF56D45A212F63F611F5D398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery spyware stealer
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2