Extracted

Extracted

Extracted

Extracted

• • Target
    2026-09-07_ffd8dffa4e0efcc70cbe5c862cf42d5a_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 1.4MB
  • SHA256 73e428db78967ea77eb1d4eef8bed215ec4f54612c3f47ed2fb5c453dd42e51d
  • MD5 ffd8dffa4e0efcc70cbe5c862cf42d5a
  • SHA1 f8eeaa23179c4185a9853975db3ddfe2a114c5af
  • SHA512 cb3b8606f73e6d811d7e2c79454861d8a835ff03fe6d0d171bf3b0cb2736e6355268f5d9050855cdf8cb083cf0de476030dbf0be590356be780afd87b835e266
  • SSDEEP 24576:0IAYVirGlcaHdHWMA3IgPAE0Yf8mZMXs2fwXuI96:0IAYVirGl19H1A3IwANYMsXh
  • TLSH
    T10C659E07F3A840ECD467C275C60A8717EB72B84A2631AADF52E54A553F67FB21B2D310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables Discord URL observed in first stage droppers

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2