2026-10-10_b718dfb188b81ca23d90c4a98b9897cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_b718dfb188b81ca23d90c4a98b9897cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 7.2MB
Sample261011-e7w8jav1fv
SHA256 5a1a4fdb324df74ff36dd62af49b4b06c4ef38e2e5242f5eee1d1102fffcbc7e
MD5 b718dfb188b81ca23d90c4a98b9897cf
SHA1 7e721fba8f0a84fed83268d4cd14d247bf38316a
SHA512 94d7c828817e153511280761274c5489bc0a230e49cb547d6850a38efae9d863fca0420cab6906b4e44f33264c3900b099b796c57aad0059c08519d7af7ccc92
SSDEEP 49152:fmWUzkUGlaBiAOX+Dhk5KCf+YBO8mVbpr74aF1LbebT7t4gXebroKqXyeFyaA5Hc:fh+DhYY7Oi1roWe8jT9PC+SaT
TLSH
T1367628117A9BA8ACD19AC870C34A4A735E2130CB1B36B9FF44D456393F69EB45B3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_b718dfb188b81ca23d90c4a98b9897cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-10_b718dfb188b81ca23d90c4a98b9897cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 7.2MB

2026-10-10_b718dfb188b81ca23d90c4a98b9897cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH ea1fe3e7ecaad30ba1cbe5b1b570291e
SHA256 5a1a4fdb324df74ff36dd62af49b4b06c4ef38e2e5242f5eee1d1102fffcbc7e
MD5 b718dfb188b81ca23d90c4a98b9897cf
SHA1 7e721fba8f0a84fed83268d4cd14d247bf38316a
SHA512 94d7c828817e153511280761274c5489bc0a230e49cb547d6850a38efae9d863fca0420cab6906b4e44f33264c3900b099b796c57aad0059c08519d7af7ccc92
SSDEEP 49152:fmWUzkUGlaBiAOX+Dhk5KCf+YBO8mVbpr74aF1LbebT7t4gXebroKqXyeFyaA5Hc:fh+DhYY7Oi1roWe8jT9PC+SaT
TLSH
T1367628117A9BA8ACD19AC870C34A4A735E2130CB1B36B9FF44D456393F69EB45B3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5750928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

llmlint.pdb

bcryptprimitives

ProcessPrng

kernel32

QueryPerformanceCounter GetExitCodeProcess QueryPerformanceFrequency CreateThread WaitForSingleObject HeapReAlloc HeapFree GetProcessHeap ReadFile CreateEventW GetOverlappedResult GetCurrentThreadId CompareStringOrdinal CreateFileW GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW TerminateProcess GetCurrentProcess WaitForMultipleObjects CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW GetSystemTimeAsFileTime lstrlenW ExitProcess SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex HeapAlloc WriteFileEx MultiByteToWideChar GetModuleHandleW FormatMessageW InitializeSListHead FindNextFileW GetTempPathW GetModuleHandleA GetFileType RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileAttributesW CancelIo GetConsoleOutputCP WriteConsoleW DeleteFileW GetFinalPathNameByHandleW FindFirstFileExW RemoveDirectoryW SetFilePointerEx DuplicateHandle GetWindowsDirectoryW GetSystemDirectoryW SetFileInformationByHandle SetFileTime SetHandleInformation GetFullPathNameW SetLastError SetUnhandledExceptionFilter GetSystemTimePreciseAsFileTime GetFileInformationByHandle FindClose CloseHandle GetFileInformationByHandleEx SleepEx SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetLastError SetConsoleMode GetConsoleMode GetStdHandle GetModuleFileNameW ReadFileEx

ntdll

RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ws2_32

freeaddrinfo getpeername WSASocketW send connect WSAStartup ioctlsocket closesocket setsockopt WSAGetLastError getaddrinfo recv getsockopt WSACleanup select

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context memcpy __C_specific_handler _CxxThrowException memcmp memmove memset __CxxFrameHandler3 __current_exception

api-ms-win-crt-math-l1-1-0

pow truncf fmod trunc round __setusermatherr ceil

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv _register_thread_local_exe_atexit_callback __p___argc _set_app_type _seh_filter_exe _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _c_exit _initterm_e exit _crt_atexit terminate _exit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_b718dfb188b81ca23d90c4a98b9897cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

ws2_32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic