2026-08-19_c09936f9829bf793eb0b2ee1952636ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_c09936f9829bf793eb0b2ee1952636ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 18.6MB
Sample260819-e4tcgadn4v
SHA256 e3a797f1894f353b62e9fd9e0157b44956e88f0a1a8a17ca784fbc4057a7f0f6
MD5 c09936f9829bf793eb0b2ee1952636ed
SHA1 ed2884617cac5ccb1b533b432cf5943310ff1fed
SHA512 950a6d92b0f0ba617534cabb2c55b7a24707fd9c3bca154449c07bda0c4af6730b2f5e6c4fcd17aa960c57603e8a66f746edb15a2bc7ad0e1e72e17399d132ab
SSDEEP 98304:XA66lJ+xuvICUu3wM97/Ck+AdUbhRuL0Ylw0JjdLLwOk9okTBcQW6prxAzTuVEqZ:JugCUBuKVuLHl4njSB4ZB
TLSH
T166173C06765F98ECD49AC874830B8A635E2034DB1B26B9FF50C442393F6EBE46B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_c09936f9829bf793eb0b2ee1952636ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-08-19_c09936f9829bf793eb0b2ee1952636ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 18.6MB

2026-08-19_c09936f9829bf793eb0b2ee1952636ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH f8b343a9c4555bdc0f6f7aaf4b2151b7
SHA256 e3a797f1894f353b62e9fd9e0157b44956e88f0a1a8a17ca784fbc4057a7f0f6
MD5 c09936f9829bf793eb0b2ee1952636ed
SHA1 ed2884617cac5ccb1b533b432cf5943310ff1fed
SHA512 950a6d92b0f0ba617534cabb2c55b7a24707fd9c3bca154449c07bda0c4af6730b2f5e6c4fcd17aa960c57603e8a66f746edb15a2bc7ad0e1e72e17399d132ab
SSDEEP 98304:XA66lJ+xuvICUu3wM97/Ck+AdUbhRuL0Ylw0JjdLLwOk9okTBcQW6prxAzTuVEqZ:JugCUBuKVuLHl4njSB4ZB
TLSH
T166173C06765F98ECD49AC874830B8A635E2034DB1B26B9FF50C442393F6EBE46B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13628640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tokmesh.pdb

combase

CoIncrementMTAUsage CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

kernel32

GetFileAttributesA CreateFileA GetTempPathA CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW AreFileApisANSI DeleteFileA LocalFree LoadLibraryExA GetFileSize GetSystemTimeAsFileTime GetSystemTime GetTickCount SetFilePointerEx SetConsoleTitleW GlobalFree SetConsoleActiveScreenBuffer CreateConsoleScreenBuffer UnlockFile GetProcAddress FreeLibrary FindNextFileW GetFileAttributesExW GetProcessHeap HeapFree GetFileType SetWaitableTimer CreateWaitableTimerExW MoveFileExW CopyFileExW SetFileAttributesW DeleteFileW GetTempPathW HeapAlloc DuplicateHandle GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetExitCodeProcess TerminateProcess CancelIo CreateEventW ExitProcess CreateDirectoryW FlushFileBuffers GetLastError GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW SetHandleInformation FormatMessageW GetComputerNameExW ReadFileEx SleepEx WriteFileEx CloseHandle GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx Sleep GetCurrentThreadId WriteConsoleW ReadConsoleW GenerateConsoleCtrlEvent GetModuleHandleA GetTimeZoneInformationForYear SystemTimeToFileTime SetThreadStackGuarantee GetCurrentThread GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo CreateThread GetSystemInfo CancelIoEx WriteFile GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort SetConsoleTextAttribute PostQueuedCompletionStatus GetOverlappedResult ReadFile GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx FillConsoleOutputCharacterA GetQueuedCompletionStatusEx WaitForSingleObject FillConsoleOutputAttribute SetConsoleCursorPosition CreateSemaphoreW SwitchToThread LockFileEx CreateFileW SetConsoleCursorInfo ReadConsoleInputW GetNumberOfConsoleInputEvents WaitForMultipleObjects GetDiskFreeSpaceA HeapReAlloc InitializeSListHead lstrlenW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetCommandLineW GlobalAlloc AddVectoredExceptionHandler GlobalUnlock MapViewOfFile CreateFileMappingW FormatMessageA HeapDestroy HeapCompact LoadLibraryW FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GlobalLock SetUnhandledExceptionFilter

oleaut32

SysStringLen GetErrorInfo SysFreeString

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

ImpersonateAnonymousToken RevertToSelf SystemFunction036

ws2_32

getsockopt closesocket shutdown WSAStartup WSACleanup connect bind WSASocketW WSAIoctl ioctlsocket getsockname send getaddrinfo WSAGetLastError freeaddrinfo recv WSASend setsockopt getpeername

ntdll

NtOpenFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtReadFile NtWriteFile NtCreateNamedPipeFile

user32

GetKeyboardLayout EmptyClipboard SetClipboardData GetWindowThreadProcessId GetForegroundWindow OpenClipboard ToUnicodeEx CloseClipboard

shell32

SHGetKnownFolderPath

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 memcpy memset memmove memcmp _CxxThrowException strchr strrchr __C_specific_handler memchr __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

round roundf pow truncf floor floorf ceil log ceilf trunc __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen strcmp strncmp strspn strcspn

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode malloc _msize

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _seh_filter_exe _set_app_type terminate _endthreadex _initterm_e _beginthreadex _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function exit _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_c09936f9829bf793eb0b2ee1952636ed_akira_cobalt-strike_glassworm_rusty-stealer_satacom

combase

api-ms-win-core-winrt-l1-1-0

kernel32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ws2_32

ntdll

user32

shell32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic