2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 3.3MB
Sample260910-ghenasygmd
SHA256 b71bedf47599d72aebd4b8845cd9c56e5fc7c8b85d62005395a609f742eb892a
MD5 50b1b19484aa83d556110d383b0993b7
SHA1 daef66e45d1d416a0db58f87a51a01c904e1106b
SHA512 dbbe491a49e9d6b4612f30067ec1c55eb789d6d1bc84b61cd0ce36937627fe97641556600f777cffa7f6944396cf9b5b3acbc434535cd90de086cc3455e4b330
SSDEEP 49152:dw2a83lEcSzPH8t94efPGsQjj2Qq4fGKRz1XisGilmCnIpFIU6iVQjX:VTJuTfSO2C+GjX
TLSH
T13AF56D03FA9585EAC08DC178C35B96337A76F8C94A24B29F2BD44E213F56B645F5C388
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 3.3MB

2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 61a1034d98233b2d481c3d12379d2ddf
SHA256 b71bedf47599d72aebd4b8845cd9c56e5fc7c8b85d62005395a609f742eb892a
MD5 50b1b19484aa83d556110d383b0993b7
SHA1 daef66e45d1d416a0db58f87a51a01c904e1106b
SHA512 dbbe491a49e9d6b4612f30067ec1c55eb789d6d1bc84b61cd0ce36937627fe97641556600f777cffa7f6944396cf9b5b3acbc434535cd90de086cc3455e4b330
SSDEEP 49152:dw2a83lEcSzPH8t94efPGsQjj2Qq4fGKRz1XisGilmCnIpFIU6iVQjX:VTJuTfSO2C+GjX
TLSH
T13AF56D03FA9585EAC08DC178C35B96337A76F8C94A24B29F2BD44E213F56B645F5C388
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1983264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

windows_update.pdb

kernel32

WaitForSingleObject GetLastError SetHandleInformation PostQueuedCompletionStatus GetQueuedCompletionStatusEx CloseHandle CreateIoCompletionPort SetFileCompletionNotificationModes GetCurrentProcess GetProcAddress Sleep GetModuleHandleA InitializeSListHead GetSystemTimeAsFileTime FindNextFileW GetModuleFileNameW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW SetUnhandledExceptionFilter GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetStdHandle GetFileInformationByHandleEx GetFileInformationByHandle GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext GetCurrentProcessId GetModuleHandleW GetComputerNameExW GetProcessHeap HeapAlloc HeapFree FormatMessageW RtlVirtualUnwind SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread

ws2_32

setsockopt getsockopt send ioctlsocket WSAIoctl WSASend closesocket connect WSASocketW shutdown getpeername getsockname freeaddrinfo getaddrinfo WSAGetLastError WSACleanup bind recv WSAStartup

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtDeviceIoControlFile NtCancelIoFileEx NtReadFile NtCreateFile RtlNtStatusToDosError NtWriteFile

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 RegQueryValueExW RegCloseKey RegOpenKeyExW

bcrypt

BCryptGenRandom

vcruntime140

memcpy __current_exception_context __current_exception memcmp memmove memset __CxxFrameHandler3 __C_specific_handler

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe _configure_narrow_argv _initterm terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initterm_e exit _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_50b1b19484aa83d556110d383b0993b7_akira_cobalt-strike_glassworm_rusty-stealer_satacom

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

advapi32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic