291f48ce4d55401894835a64bad2aaf7859d661bd12ec0c440d972191f2e5ad4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 06:51

Target
2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 15.3MB
Sample260908-hmmp5stdnc
SHA256 291f48ce4d55401894835a64bad2aaf7859d661bd12ec0c440d972191f2e5ad4
MD5 bfd672bb87a04263c953f23acd96938e
SHA1 a674d11d2e851c92adcf27dfcbf7c34487e2259e
SHA512 96ad7f8dfe1c897edba24867cce419d6fd68ae73ca142bc53feb4bfec64c0addec1d834d9d2d1695c1b7a5ba4d343f557a01ac28d9e2d0b0b528b941fdba4189
SSDEEP 98304:60uZpbqLertb75tRmrFhb/l0w1P2m/0iiiiiVWiz4T+7cBmxbyigvLZ63:XLob7AJXe0aUyJC
TLSH
T171F606116B9E98ADD09AC874834A4B735A3130DB1B35B9FF44D446793FAAAF41B3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"	2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"	2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

C:\Users\Admin\AppData\Local\Temp\2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Adds Run key to start application
PID:4564

C:\Users\Admin\AppData\Local\Temp\2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
1⤵
- Adds Run key to start application
PID:4480