General

  • Target
    2026-08-20_21e94a1f0410506b915b6b068c9ae3a5_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 5.4MB
  • Sample260821-dsbslsfn81
  • SHA256 c2530dc4aad53ffbfdbf9529fce29fb2bb220f9af7c5be33d464d5a7838418b4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      2026-08-20_21e94a1f0410506b915b6b068c9ae3a5_akira_cobalt-strike_glassworm_rusty-stealer_satacom
    • Size 5.4MB
    • SHA256 c2530dc4aad53ffbfdbf9529fce29fb2bb220f9af7c5be33d464d5a7838418b4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

    • Uses browser remote debugging

      Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

MITRE ATT&CK Enterprise v16

Tasks