2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 17.8MB
Sample260924-pkrpmsvtbs
SHA256 89ca755e300aba35be0fecfafc4ea2d900109264400ab2a83a2556de75738a68
MD5 252261264df5db520d81970aaf9bec67
SHA1 cd22f7a5db1f40cf175db1e13bf819f2ba3af4f0
SHA512 c8fb4c92c0b7ef951a2fb2c0688a972d3a258c2e518719242acbcba77eb29806ae6a040a5d0100c1334f447cb81941731580f7f299a353dfb932bef6e16c7e3d
SSDEEP 196608:waRf5JCikhg0ONIoKCNFt8J+6sULM2e52eCqU6Tq7lD9kY:w4NL0ONIoKCNFt8J+6sU7gZCGTq7l5J
TLSH
T1B8170921BA6A596CE046C4B4838786729A7130CF0B3579FF44D482393F69BF95F3825E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 17.8MB

2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 95adad3459eacccfe2982c5972d06f16
SHA256 89ca755e300aba35be0fecfafc4ea2d900109264400ab2a83a2556de75738a68
MD5 252261264df5db520d81970aaf9bec67
SHA1 cd22f7a5db1f40cf175db1e13bf819f2ba3af4f0
SHA512 c8fb4c92c0b7ef951a2fb2c0688a972d3a258c2e518719242acbcba77eb29806ae6a040a5d0100c1334f447cb81941731580f7f299a353dfb932bef6e16c7e3d
SSDEEP 196608:waRf5JCikhg0ONIoKCNFt8J+6sULM2e52eCqU6Tq7lD9kY:w4NL0ONIoKCNFt8J+6sU7gZCGTq7l5J
TLSH
T1B8170921BA6A596CE046C4B4838786729A7130CF0B3579FF44D482393F69BF95F3825E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18677760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

advapi32

RegGetValueW RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW EventRegister EventSetInformation EventWriteTransfer RegSetValueExW EventUnregister IsValidSid GetLengthSid CopySid OpenProcessToken GetTokenInformation SystemFunction036

ntdll

NtDeviceIoControlFile NtQueryInformationProcess RtlNtStatusToDosError NtQuerySystemInformation NtOpenFile NtWriteFile NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile RtlGetVersion NtReadFile

kernel32

GetModuleHandleA OpenProcess VirtualAllocEx WriteProcessMemory GetModuleHandleW Sleep GetCurrentThreadId CloseHandle RtlPcToFileHeader ReleaseSRWLockExclusive RaiseException FlsAlloc WaitForSingleObject FindNextFileW GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess FindClose FlsGetValue FlsSetValue FindFirstFileExW GetCurrentProcess DuplicateHandle SetFileCompletionNotificationModes GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW FreeLibrary GetCommandLineW GetCurrentDirectoryW GetCurrentThread FlsFree SetThreadStackGuarantee AddVectoredExceptionHandler AcquireSRWLockExclusive SetFilePointerEx CreateDirectoryW GetStdHandle TerminateProcess EncodePointer InitializeSListHead GetWindowsDirectoryW WakeAllConditionVariable GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx LoadLibraryExA CancelIo HeapAlloc GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FormatMessageW SetUnhandledExceptionFilter CreateRemoteThread CreateProcessW CreatePipe ReadFile WriteFile GetNamedPipeClientProcessId GetNamedPipeServerProcessId DisconnectNamedPipe CreateFileW WaitNamedPipeW ConnectNamedPipe CreateNamedPipeW ReadFileEx CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW SetLastError LoadLibraryW SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal CreateEventW RtlUnwindEx ReadProcessMemory GetProcessIoCounters LoadLibraryA lstrlenW GetSystemTimes SetHandleInformation LocalFree FlushFileBuffers SleepConditionVariableSRW GetSystemTimeAsFileTime GetFullPathNameW GetProcAddress DeviceIoControl GetExitCodeProcess GetProcessTimes InitializeCriticalSectionEx VirtualQueryEx LCIDToLocaleName K32GetPerformanceInfo GlobalMemoryStatusEx GetCurrentProcessId GetSystemInfo GetEnvironmentVariableW GetUserDefaultUILanguage AssignProcessToJobObject SetInformationJobObject CreateJobObjectW Module32Next Module32First CreateToolhelp32Snapshot GetProcessId GetConsoleMode GetFileInformationByHandle PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx GetOverlappedResult DeleteCriticalSection

user32

SetWindowLongPtrW GetWindowRect FindWindowExW EnableMenuItem SetWindowRgn RegisterTouchWindow EnableWindow ClipCursor SetWindowLongW AdjustWindowRectEx IsProcessDPIAware SetPropW GetDC GetSystemMenu ReleaseDC GetWindow ShowCursor IsWindowEnabled AllowSetForegroundWindow DestroyIcon MapWindowPoints SendInput TranslateAcceleratorW GetMessageA RegisterClassExW GetParent RegisterRawInputDevices GetForegroundWindow CreateWindowExW EnumChildWindows ReleaseCapture SetCapture DispatchMessageA GetClipCursor SetFocus GetWindowThreadProcessId MsgWaitForMultipleObjectsEx SystemParametersInfoA SetWindowDisplayAffinity GetKeyboardLayout IsWindowVisible GetRawInputData VkKeyScanW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable DrawIconEx GetMenuItemInfoW CreateIcon GetMenu MonitorFromPoint GetAsyncKeyState GetKeyboardState MapVirtualKeyExW ToUnicodeEx GetKeyState RegisterWindowMessageA SetParent EnumDisplayMonitors SetWindowTextW GetWindowLongPtrW EnumWindows FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos ShowWindow LoadCursorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW GetWindowTextW FillRect GetWindowTextLengthW GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient IsWindow DefWindowProcW PostThreadMessageW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW IsIconic SendMessageW RedrawWindow AdjustWindowRect SetForegroundWindow DestroyWindow

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

ole32

CoTaskMemAlloc CoCreateInstance RevokeDragDrop CoCreateFreeThreadedMarshaler CoInitializeEx CoInitialize CoUninitialize CoTaskMemFree OleInitialize RegisterDragDrop

gdi32

CreateCompatibleDC CombineRgn GetDeviceCaps DeleteDC BitBlt CreateRectRgn CreateDIBSection SetTextColor SetBkMode DeleteObject CreateSolidBrush SelectObject

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath ShellExecuteExW SHOpenFolderAndSelectItems ILCreateFromPathW SHAppBarMessage ILFree SHCreateItemFromParsingName DragFinish CommandLineToArgvW ShellExecuteW DragQueryFileW

oleaut32

SysStringLen SetErrorInfo GetErrorInfo SysFreeString

bcrypt

BCryptGenRandom

secur32

InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW EncryptMessage DecryptMessage ApplyControlToken AcquireCredentialsHandleA FreeCredentialsHandle DeleteSecurityContext FreeContextBuffer

ws2_32

WSAStartup WSACleanup shutdown freeaddrinfo WSAGetLastError closesocket getaddrinfo ioctlsocket bind WSASocketW WSAIoctl recv WSASend send getsockname getpeername getsockopt setsockopt connect

crypt32

CertFreeCertificateChain CertDuplicateCertificateChain CertCloseStore CertOpenStore CertEnumCertificatesInStore CertDuplicateStore CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore

pdh

PdhCloseQuery PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue PdhRemoveCounter PdhAddEnglishCounterW

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

api-ms-win-crt-string-l1-1-0

strlen wcscmp strcpy_s wcslen _wcsicmp

api-ms-win-crt-math-l1-1-0

round floor __setusermatherr roundf trunc pow

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-heap-l1-1-0

free calloc malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _seh_filter_exe _set_app_type _initialize_narrow_environment _cexit _crt_atexit terminate _get_initial_narrow_environment _c_exit _initterm abort _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _initterm_e exit _exit _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

627KB

Virtual Size

627KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcdf17

Size

428KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_252261264df5db520d81970aaf9bec67_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

advapi32

ntdll

kernel32

user32

api-ms-win-core-synch-l1-2-0

comctl32

ole32

gdi32

dwmapi

shlwapi

shell32

oleaut32

bcrypt

secur32

ws2_32

crypt32

pdh

powrprof

psapi

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic