2026-10-01_9f8a384366ebe07afe8865b4a91ed7ce_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_9f8a384366ebe07afe8865b4a91ed7ce_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 12.9MB
Sample261002-jblt5swemc
SHA256 b7c669893cc72ea0e048284c9a093c46e3644081fd0a788cba4584a4a5443aa0
MD5 9f8a384366ebe07afe8865b4a91ed7ce
SHA1 1e55a4710109315dd876cbf3e6e999f3de198429
SHA512 4c892553a7bbac2a7eda3de4cccae33fd3fb21db344b4fd70fef0e3a9dd1a8238729cf5e2c78d579370800ad1ffbaba43c77b1124152fd719e0bd11d0c740c50
SSDEEP 98304:J7kpNq4jJOLq0R5on4ARFgU2cB/CCat5/BMoZUnbt47iqdOyuzoo6Fl98DvccsEI:6jDLcQXCW/ccsE1J0
TLSH
T170D629117A6BA8ACD59AC870834A4A735E2170DB1B26B9FF41C446393F6DBF01F39718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_9f8a384366ebe07afe8865b4a91ed7ce_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-01_9f8a384366ebe07afe8865b4a91ed7ce_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 12.9MB

2026-10-01_9f8a384366ebe07afe8865b4a91ed7ce_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 72d1cbda08228cd1cf5ad2570567340d
SHA256 b7c669893cc72ea0e048284c9a093c46e3644081fd0a788cba4584a4a5443aa0
MD5 9f8a384366ebe07afe8865b4a91ed7ce
SHA1 1e55a4710109315dd876cbf3e6e999f3de198429
SHA512 4c892553a7bbac2a7eda3de4cccae33fd3fb21db344b4fd70fef0e3a9dd1a8238729cf5e2c78d579370800ad1ffbaba43c77b1124152fd719e0bd11d0c740c50
SSDEEP 98304:J7kpNq4jJOLq0R5on4ARFgU2cB/CCat5/BMoZUnbt47iqdOyuzoo6Fl98DvccsEI:6jDLcQXCW/ccsE1J0
TLSH
T170D629117A6BA8ACD59AC870834A4A735E2170DB1B26B9FF41C446393F6DBF01F39718
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9823392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

upd.pdb

bcryptprimitives

ProcessPrng

kernel32

WaitForSingleObjectEx LoadLibraryA GetCurrentProcess GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex GetConsoleOutputCP HeapFree WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetStdHandle ReadFileEx SleepEx WriteFileEx HeapReAlloc GetSystemInfo SetHandleInformation GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW GetSystemTimePreciseAsFileTime GetProcessHeap ReadConsoleW CreateDirectoryW ExitProcess CreateEventW CancelIo GetModuleHandleW GetExitCodeProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread FindClose WaitForMultipleObjects UnregisterWaitEx GetTempPathW DeleteFileW SetFileAttributesW GetFileType SetThreadStackGuarantee GetCurrentThread SetFilePointerEx MoveFileExW RegisterWaitForSingleObject GetConsoleMode SetConsoleMode SetConsoleTextAttribute FlushFileBuffers GetFileInformationByHandleEx CreateFileW GetCurrentThreadId GetConsoleScreenBufferInfo GetProcAddress GetModuleHandleA lstrlenW SwitchToThread GetFileInformationByHandle Sleep GetLastError CloseHandle GetDynamicTimeZoneInformation GetSystemTimeAsFileTime FindNextFileW GetOverlappedResult PostQueuedCompletionStatus WriteFile ReadFile GetQueuedCompletionStatusEx TerminateProcess CreateIoCompletionPort DeviceIoControl CancelIoEx GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes SetUnhandledExceptionFilter InitializeSListHead GetCommandLineW AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW FreeEnvironmentStringsW QueryPerformanceCounter GetEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

crypt32

CertDuplicateStore CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertCloseStore CertVerifyCertificateChainPolicy CertOpenStore CertCreateCertificateContext CertDuplicateCertificateContext CertFreeCertificateContext

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

ws2_32

getaddrinfo freeaddrinfo send setsockopt WSACleanup WSAStartup shutdown WSASend getpeername getsockopt connect bind WSAIoctl ioctlsocket WSAGetLastError WSASocketW closesocket getsockname recv

ntdll

NtDeviceIoControlFile NtReadFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile NtCreateFile NtCreateNamedPipeFile NtOpenFile

secur32

ApplyControlToken DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleA DeleteSecurityContext QueryContextAttributesW AcceptSecurityContext FreeContextBuffer InitializeSecurityContextW EncryptMessage

userenv

GetUserProfileDirectoryW

vcruntime140

memset memcpy __current_exception_context memcmp __CxxFrameHandler3 memmove _CxxThrowException __C_specific_handler __current_exception

api-ms-win-crt-math-l1-1-0

pow ceil __setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_exit _seh_filter_exe __p___argc __p___argv _initterm _c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _get_initial_narrow_environment _cexit _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_9f8a384366ebe07afe8865b4a91ed7ce_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

crypt32

shell32

combase

ws2_32

ntdll

secur32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic