2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 10.7MB
Sample260903-yry7qseq3t
SHA256 06965fe846e4ad87b84c8e4edd9a5378bd6293474f044d3fadc04aa8665625cc
MD5 e6d869cc6aa1f94056d617c192967fee
SHA1 dbb59a50805f57b27141e98093278a9d396f149e
SHA512 3f63b432bc9ad1d90ea390f0e18d806184e7e9b83adc3b0ef22f97696ee82843e7587dc70e2c793d2f1fae3214fd7f04901941daa03d870967712faa9d31cfbc
SSDEEP 98304:rtt4kfaQ6KP3KM9VMAKpZfMOMt2zbQSSEpWyDKX6e9fs8FcBiqoMaNHV+F7NP:rttfaQ6K9N16els8nV+F7NP
TLSH
T1ACB6E5257A5A99ACC05BC474834B8A72497170DB0B39B9FF448492383F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 10.7MB

2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH d1a7a636df9a3e5bb0dbbe2c3cd302f0
SHA256 06965fe846e4ad87b84c8e4edd9a5378bd6293474f044d3fadc04aa8665625cc
MD5 e6d869cc6aa1f94056d617c192967fee
SHA1 dbb59a50805f57b27141e98093278a9d396f149e
SHA512 3f63b432bc9ad1d90ea390f0e18d806184e7e9b83adc3b0ef22f97696ee82843e7587dc70e2c793d2f1fae3214fd7f04901941daa03d870967712faa9d31cfbc
SSDEEP 98304:rtt4kfaQ6KP3KM9VMAKpZfMOMt2zbQSSEpWyDKX6e9fs8FcBiqoMaNHV+F7NP:rttfaQ6K9N16els8nV+F7NP
TLSH
T1ACB6E5257A5A99ACC05BC474834B8A72497170DB0B39B9FF448492383F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7631184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

infinite_jump.pdb

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW RegQueryValueExW RegCloseKey RegOpenKeyExW RegGetValueW EventWriteTransfer EventSetInformation EventRegister EventUnregister

ntdll

NtOpenFile NtDeviceIoControlFile NtReadFile NtCreateNamedPipeFile NtCreateFile NtWriteFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError

kernel32

AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive GetLastError GetProcAddress CloseHandle Sleep GetModuleHandleA LoadLibraryExW RtlPcToFileHeader RaiseException GetCurrentThreadId FindNextFileW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemTimeAsFileTime CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW FlsAlloc FlsGetValue MultiByteToWideChar QueryPerformanceFrequency GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree SleepEx ReadFileEx FreeLibrary FlsSetValue GetTempPathW SetEnvironmentVariableW GetSystemDirectoryW FindClose FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW SwitchToThread FlsFree GetFileInformationByHandleEx DeviceIoControl CreateDirectoryW LoadLibraryExA HeapAlloc GetCommandLineW GetEnvironmentStringsW FormatMessageW GetCurrentDirectoryW SetLastError GetCurrentThread EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx SetThreadStackGuarantee AddVectoredExceptionHandler CreateFileW GetFileInformationByHandle GetConsoleMode WaitForSingleObject DuplicateHandle SetNamedPipeHandleState SetFileInformationByHandle ReleaseMutex lstrlenW CreateMutexA GetCurrentProcessId LoadLibraryW WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess HeapReAlloc GetEnvironmentVariableW GetModuleHandleW SetCurrentDirectoryW InitializeCriticalSectionEx LoadLibraryA GetFullPathNameW ExitProcess SetThreadErrorMode CreateIoCompletionPort GetQueuedCompletionStatusEx CancelIoEx LCIDToLocaleName GetUserDefaultUILanguage WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult SetFileCompletionNotificationModes DeleteCriticalSection SetHandleInformation

user32

EnableWindow IsProcessDPIAware GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW AdjustWindowRectEx SetCapture SetWindowRgn CreateWindowExW IsWindow ShowWindow IsWindowEnabled GetWindow RegisterTouchWindow ReleaseCapture RegisterRawInputDevices DestroyIcon GetKeyboardLayout MessageBoxW GetRawInputData GetDC EnumChildWindows DispatchMessageA GetMessageA RegisterClassExW SetFocus ReleaseDC MonitorFromPoint EnumDisplayMonitors SetWindowDisplayAffinity IsWindowVisible GetClipCursor ClipCursor MapWindowPoints ShowCursor SetParent GetMenu SetForegroundWindow SendInput GetWindowTextLengthW RegisterWindowMessageA GetWindowTextW SetWindowTextW GetSystemMenu EnableMenuItem SetWindowLongW SetPropW DestroyWindow VkKeyScanW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable GetMenuItemInfoW DrawIconEx CreateIcon ToUnicodeEx GetKeyState GetAsyncKeyState MsgWaitForMultipleObjectsEx TranslateAcceleratorW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx DefWindowProcW GetMessageW GetKeyboardState MapVirtualKeyW LoadCursorW PostMessageW GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos AdjustWindowRect DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetMonitorInfoW MonitorFromWindow GetCursorPos SetCursor GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW MapVirtualKeyExW FillRect SystemParametersInfoA MonitorFromRect ClientToScreen GetClientRect GetWindowLongW ScreenToClient RedrawWindow IsIconic SendMessageW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoCreateFreeThreadedMarshaler OleInitialize RevokeDragDrop CoUninitialize RegisterDragDrop CoTaskMemFree CoInitializeEx

comctl32

TaskDialogIndirect DefSubclassProc SetWindowSubclass RemoveWindowSubclass

gdi32

BitBlt CreateDIBSection SelectObject CreateCompatibleDC DeleteDC GetDeviceCaps CreateRectRgn CombineRgn SetTextColor SetBkMode DeleteObject CreateSolidBrush

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

shell32

DragQueryFileW DragFinish SHOpenFolderAndSelectItems SHAppBarMessage ShellExecuteExW SHGetKnownFolderPath ILFree ILCreateFromPathW ShellExecuteW

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

ws2_32

WSACleanup WSAStartup getsockname WSASend send setsockopt ioctlsocket connect recv WSAIoctl WSASocketW bind shutdown getsockopt WSAGetLastError freeaddrinfo getaddrinfo closesocket getpeername

secur32

FreeCredentialsHandle DecryptMessage AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW ApplyControlToken FreeContextBuffer EncryptMessage DeleteSecurityContext AcquireCredentialsHandleA

crypt32

CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertCloseStore CertDuplicateStore CertOpenStore

api-ms-win-crt-math-l1-1-0

round floor trunc roundf pow __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment terminate _initterm _crt_atexit _initterm_e _exit _set_app_type __p___argc __p___argv _cexit _c_exit abort _register_onexit_function _register_thread_local_exe_atexit_callback _initialize_onexit_table exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc free _callnewh malloc _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_e6d869cc6aa1f94056d617c192967fee_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

advapi32

ntdll

kernel32

user32

api-ms-win-core-synch-l1-2-0

ole32

comctl32

gdi32

dwmapi

shlwapi

shell32

oleaut32

ws2_32

secur32

crypt32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic