06965fe846e4ad87b84c8e4edd9a5378bd6293474f044d3fadc04aa8665625cc

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 20:01

Target
2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 10.7MB
Sample260903-yry7qseq3t
SHA256 06965fe846e4ad87b84c8e4edd9a5378bd6293474f044d3fadc04aa8665625cc
MD5 e6d869cc6aa1f94056d617c192967fee
SHA1 dbb59a50805f57b27141e98093278a9d396f149e
SHA512 3f63b432bc9ad1d90ea390f0e18d806184e7e9b83adc3b0ef22f97696ee82843e7587dc70e2c793d2f1fae3214fd7f04901941daa03d870967712faa9d31cfbc
SSDEEP 98304:rtt4kfaQ6KP3KM9VMAKpZfMOMt2zbQSSEpWyDKX6e9fs8FcBiqoMaNHV+F7NP:rttfaQ6K9N16els8nV+F7NP
TLSH
T1ACB6E5257A5A99ACC05BC474834B8A72497170DB0B39B9FF448492383F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Downloads MZ/PE file 2 IoCs

flow	pid	Process
4	4320	2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
6	4320	2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

C:\Users\Admin\AppData\Local\Temp\2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Downloads MZ/PE file
PID:4320

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact