General
- Target 2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 3.3MB
- Sample260910-ghenasygmd
- SHA256 b71bedf47599d72aebd4b8845cd9c56e5fc7c8b85d62005395a609f742eb892a
- MD5 50b1b19484aa83d556110d383b0993b7
- SHA1 daef66e45d1d416a0db58f87a51a01c904e1106b
- SHA512 dbbe491a49e9d6b4612f30067ec1c55eb789d6d1bc84b61cd0ce36937627fe97641556600f777cffa7f6944396cf9b5b3acbc434535cd90de086cc3455e4b330
- SSDEEP 49152:dw2a83lEcSzPH8t94efPGsQjj2Qq4fGKRz1XisGilmCnIpFIU6iVQjX:VTJuTfSO2C+GjX
- TLSH T13AF56D03FA9585EAC08DC178C35B96337A76F8C94A24B29F2BD44E213F56B645F5C388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
- Size 3.3MB
- SHA256 b71bedf47599d72aebd4b8845cd9c56e5fc7c8b85d62005395a609f742eb892a
- MD5 50b1b19484aa83d556110d383b0993b7
- SHA1 daef66e45d1d416a0db58f87a51a01c904e1106b
- SHA512 dbbe491a49e9d6b4612f30067ec1c55eb789d6d1bc84b61cd0ce36937627fe97641556600f777cffa7f6944396cf9b5b3acbc434535cd90de086cc3455e4b330
- SSDEEP 49152:dw2a83lEcSzPH8t94efPGsQjj2Qq4fGKRz1XisGilmCnIpFIU6iVQjX:VTJuTfSO2C+GjX
- TLSH T13AF56D03FA9585EAC08DC178C35B96337A76F8C94A24B29F2BD44E213F56B645F5C388
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.