f45438c0995228c1f0d8885e7ff7d991aeed55c77d27fbe449bcd4d3b2048168

General

Target
2026-09-08_f1457ff53f3c68cd3dcebf380a4c5495_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 8.5MB
Sample260910-b6lhvsv1cy
SHA256 f45438c0995228c1f0d8885e7ff7d991aeed55c77d27fbe449bcd4d3b2048168
MD5 f1457ff53f3c68cd3dcebf380a4c5495
SHA1 94321de3fd7834604cd969c7627a03e95fcefdb4
SHA512 cbfd4a2ecc9113405c56110094daa50f7ba75d3b8253db854c1d51ff17efe890dcd558d18455bee2ed96e46d74a0ecbe3b49de756e7ea77bbdbafa0424eb642a
SSDEEP 98304:EeYJ3pdVz2WlpJhKnj9ZBZxZUUhnzmo7Y2+JwXX:RAzAO7hKnj9OeCw
TLSH
T1B6966B12BB5A55EDD19AC07483464B739A3170CA0B35BAFF458486393F6AAF11F3C368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-08_f1457ff53f3c68cd3dcebf380a4c5495_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 8.5MB
- SHA256 f45438c0995228c1f0d8885e7ff7d991aeed55c77d27fbe449bcd4d3b2048168
- MD5 f1457ff53f3c68cd3dcebf380a4c5495
- SHA1 94321de3fd7834604cd969c7627a03e95fcefdb4
- SHA512 cbfd4a2ecc9113405c56110094daa50f7ba75d3b8253db854c1d51ff17efe890dcd558d18455bee2ed96e46d74a0ecbe3b49de756e7ea77bbdbafa0424eb642a
- SSDEEP 98304:EeYJ3pdVz2WlpJhKnj9ZBZxZUUhnzmo7Y2+JwXX:RAzAO7hKnj9OeCw
- TLSH
  T1B6966B12BB5A55EDD19AC07483464B739A3170CA0B35BAFF458486393F6AAF11F3C368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence ransomware spyware stealer
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1 behavioral2