54e8e9296842e9e949b7b7c769f4dc6728eb57b7954bbabe12bc8b86d4e9673e

General

Target
2026-09-07_708de81feabfea4aadedb1d7bd31d2bd_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 8.7MB
Sample260908-3abgkaygpc
SHA256 54e8e9296842e9e949b7b7c769f4dc6728eb57b7954bbabe12bc8b86d4e9673e
MD5 708de81feabfea4aadedb1d7bd31d2bd
SHA1 2f7bc33afbb0ec4080b74a015fcf9a18d22aafa2
SHA512 e544bc1175c4be2e7378d0a182698e81261bf64b39420456c36d5340c4ef5c5af9831c3f7433e793d16900659df03b82f84c9d92a421bf15187efd60611f4c35
SSDEEP 98304:8/DeMMtnYGJLJKcd9RgVWmzZGsLStMXHoAp0A6+4cdELyi4BTu:GQtfjKG7giAoAavcdzJ5
TLSH
T16D966B12BA5A55EDC19AC47483464A73AA3170CB0B35BAFF44D086393F6AAF11F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-07_708de81feabfea4aadedb1d7bd31d2bd_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 8.7MB
- SHA256 54e8e9296842e9e949b7b7c769f4dc6728eb57b7954bbabe12bc8b86d4e9673e
- MD5 708de81feabfea4aadedb1d7bd31d2bd
- SHA1 2f7bc33afbb0ec4080b74a015fcf9a18d22aafa2
- SHA512 e544bc1175c4be2e7378d0a182698e81261bf64b39420456c36d5340c4ef5c5af9831c3f7433e793d16900659df03b82f84c9d92a421bf15187efd60611f4c35
- SSDEEP 98304:8/DeMMtnYGJLJKcd9RgVWmzZGsLStMXHoAp0A6+4cdELyi4BTu:GQtfjKG7giAoAavcdzJ5
- TLSH
  T16D966B12BA5A55EDC19AC47483464A73AA3170CB0B35BAFF44D086393F6AAF11F3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence ransomware spyware stealer
- Detects Reflective DLL injection artifacts
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2