2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 15.3MB
Sample260908-hmmp5stdnc
SHA256 291f48ce4d55401894835a64bad2aaf7859d661bd12ec0c440d972191f2e5ad4
MD5 bfd672bb87a04263c953f23acd96938e
SHA1 a674d11d2e851c92adcf27dfcbf7c34487e2259e
SHA512 96ad7f8dfe1c897edba24867cce419d6fd68ae73ca142bc53feb4bfec64c0addec1d834d9d2d1695c1b7a5ba4d343f557a01ac28d9e2d0b0b528b941fdba4189
SSDEEP 98304:60uZpbqLertb75tRmrFhb/l0w1P2m/0iiiiiVWiz4T+7cBmxbyigvLZ63:XLob7AJXe0aUyJC
TLSH
T171F606116B9E98ADD09AC874834A4B735A3130DB1B35B9FF44D446793FAAAF41B3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 15.3MB

2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH e3e0406487c1fbb8208c708f805ed4b1
SHA256 291f48ce4d55401894835a64bad2aaf7859d661bd12ec0c440d972191f2e5ad4
MD5 bfd672bb87a04263c953f23acd96938e
SHA1 a674d11d2e851c92adcf27dfcbf7c34487e2259e
SHA512 96ad7f8dfe1c897edba24867cce419d6fd68ae73ca142bc53feb4bfec64c0addec1d834d9d2d1695c1b7a5ba4d343f557a01ac28d9e2d0b0b528b941fdba4189
SSDEEP 98304:60uZpbqLertb75tRmrFhb/l0w1P2m/0iiiiiVWiz4T+7cBmxbyigvLZ63:XLob7AJXe0aUyJC
TLSH
T171F606116B9E98ADD09AC874834A4B735A3130DB1B35B9FF44D446793FAAAF41B3C318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11823420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ducky_interpreter.pdb

bcryptprimitives

ProcessPrng

kernel32

HeapFree AreFileApisANSI GetLastError HeapAlloc FormatMessageW GetModuleHandleW SetNamedPipeHandleState GetProcessHeap UnregisterWaitEx GetCurrentProcess DuplicateHandle RegisterWaitForSingleObject GetModuleHandleA GetProcAddress OpenProcess CreateFileW LoadLibraryA CloseHandle LocalFree GetLogicalDrives GetDriveTypeW SetFileAttributesW SetHandleInformation FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetCurrentProcessId GetFileSize LockFileEx UnlockFile HeapDestroy LoadLibraryW GetSystemInfo PostQueuedCompletionStatus GetOverlappedResult CancelIoEx CreateIoCompletionPort HeapReAlloc DeleteFileW GetQueuedCompletionStatusEx DeleteFileA WaitForSingleObjectEx SetFileCompletionNotificationModes InitializeSListHead CreateFileA FlushViewOfFile ReadFile HeapCreate GetFileAttributesExW GetFileAttributesA GetFullPathNameW WriteFile GetDiskFreeSpaceA GetDiskFreeSpaceW LockFile SetFilePointer CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFullPathNameA GetTempPathA SystemTimeToFileTime QueryPerformanceCounter FormatMessageA WideCharToMultiByte OutputDebugStringW MultiByteToWideChar OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection Sleep HeapSize lstrlenW RtlVirtualUnwind HeapValidate UnmapViewOfFile GetFileAttributesW WaitForSingleObject CreateMutexW CreateEventW GetTempPathW UnlockFileEx SetEndOfFile GlobalLock GlobalSize GlobalUnlock GetCurrentThreadId GlobalAlloc FindNextFileW GlobalFree WaitForMultipleObjects SetUnhandledExceptionFilter GetModuleFileNameW HeapCompact SetWaitableTimer CompareStringOrdinal CreateWaitableTimerExW FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetConsoleOutputCP SetFileInformationByHandle SetFileTime QueryPerformanceFrequency CreateThread GetConsoleMode ReadFileEx RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime WriteConsoleW CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW CopyFileExW FindFirstFileExW FindClose SwitchToThread CreateMutexA ReleaseMutex GetFinalPathNameByHandleW

advapi32

RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW RegOpenKeyExA CredReadW RegDeleteValueA RegSaveKeyA RegQueryValueExW RegOpenKeyExW RegCloseKey SystemFunction036 RegSetValueExA

crypt32

CertAddCertificateContextToStore CryptUnprotectData CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertFreeCertificateContext CertDuplicateStore CertDuplicateCertificateChain CertCloseStore CertFreeCertificateChain CertEnumCertificatesInStore CertOpenStore

ws2_32

setsockopt closesocket send WSASend recv getsockname getpeername getsockopt ioctlsocket WSAIoctl bind getaddrinfo shutdown connect freeaddrinfo socket WSAGetLastError WSAStartup WSACleanup WSASocketW

secur32

EncryptMessage AcceptSecurityContext FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext ApplyControlToken FreeContextBuffer InitializeSecurityContextW DecryptMessage AcquireCredentialsHandleA

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcrypt

BCryptGenRandom

ntdll

NtReadFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtOpenFile NtWriteFile NtCreateNamedPipeFile

user32

VkKeyScanW keybd_event CloseClipboard OpenClipboard GetClipboardData MapVirtualKeyW EmptyClipboard SetClipboardData SendInput

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

vcruntime140

__current_exception_context _CxxThrowException memchr __C_specific_handler strrchr strchr memmove memset memcmp __CxxFrameHandler3 memcpy __current_exception

api-ms-win-crt-string-l1-1-0

strlen strspn strcmp strcspn strncmp

api-ms-win-crt-heap-l1-1-0

_msize realloc _set_new_mode malloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _endthreadex _initialize_narrow_environment terminate _seh_filter_exe __p___argc _get_initial_narrow_environment _initterm _initterm_e _register_onexit_function __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback exit _crt_atexit _beginthreadex _exit _initialize_onexit_table _set_app_type

api-ms-win-crt-math-l1-1-0

log pow __setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_bfd672bb87a04263c953f23acd96938e_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

advapi32

crypt32

ws2_32

secur32

api-ms-win-core-synch-l1-2-0

bcrypt

ntdll

user32

shell32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic