2026-10-18_3c1baa1219de385fc055a3d8b203429a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_3c1baa1219de385fc055a3d8b203429a_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 15.3MB
Sample261018-s3k7csbf33
SHA256 511e052ebe3586a30c3cb4e0054ec2bfb0a9730dc1f107ea71ce6ed747de8f9a
MD5 3c1baa1219de385fc055a3d8b203429a
SHA1 74d07133cce1c02f62d0d60f856bac959588afb8
SHA512 64f8bb95f5334cc8e56d5d4b706895b34def53a1c4c31a3846e25186c1cb2ee4e67dc7a4265d1a58c46723521fda84e62cad8b13a28d998e5b2b7872247905c5
SSDEEP 98304:5jEgikEpRQhpCcCFLS7g4qv10yWomWjmCOMtiX/zxxkTc3uA8Bhe6qxWpOyuzoos:1eV65saQTytiTqIMxI
TLSH
T11BF61A11BA6B98ACD19AC87083064A735E2174DB1B26B9FF40C496393F6DBF05F39718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_3c1baa1219de385fc055a3d8b203429a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-18_3c1baa1219de385fc055a3d8b203429a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 15.3MB

2026-10-18_3c1baa1219de385fc055a3d8b203429a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH 60d251f2ac7047a81e2e0a094fd3405c
SHA256 511e052ebe3586a30c3cb4e0054ec2bfb0a9730dc1f107ea71ce6ed747de8f9a
MD5 3c1baa1219de385fc055a3d8b203429a
SHA1 74d07133cce1c02f62d0d60f856bac959588afb8
SHA512 64f8bb95f5334cc8e56d5d4b706895b34def53a1c4c31a3846e25186c1cb2ee4e67dc7a4265d1a58c46723521fda84e62cad8b13a28d998e5b2b7872247905c5
SSDEEP 98304:5jEgikEpRQhpCcCFLS7g4qv10yWomWjmCOMtiX/zxxkTc3uA8Bhe6qxWpOyuzoos:1eV65saQTytiTqIMxI
TLSH
T11BF61A11BA6B98ACD19AC87083064A735E2174DB1B26B9FF40C496393F6DBF05F39718
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11791536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

upd.pdb

bcryptprimitives

ProcessPrng

kernel32

GetCurrentProcess GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex GetConsoleOutputCP WaitForSingleObjectEx WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc lstrlenW ReadFileEx SleepEx WriteFileEx Sleep GetModuleHandleA SetHandleInformation GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandleEx SwitchToThread ReadConsoleW CreateDirectoryW ExitProcess CreateEventW CancelIo TerminateProcess GetExitCodeProcess CompareStringOrdinal GetCurrentThreadId GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread GetConsoleMode WaitForMultipleObjects GetProcAddress GetTempPathW DeleteFileW SetFileAttributesW SetConsoleTextAttribute GetProcessHeap HeapFree SetFilePointerEx MoveFileExW RegisterWaitForSingleObject GetStdHandle HeapReAlloc GetSystemInfo DeviceIoControl FlushFileBuffers CopyFileExW GetCurrentThread LoadLibraryA GetSystemTimePreciseAsFileTime SetConsoleMode FindClose SetThreadStackGuarantee GetModuleHandleW CreateFileW UnregisterWaitEx GetLastError CloseHandle GetConsoleScreenBufferInfo GetDynamicTimeZoneInformation GetSystemTimeAsFileTime GetFileInformationByHandle FindNextFileW GetOverlappedResult PostQueuedCompletionStatus WriteFile ReadFile GetQueuedCompletionStatusEx GetSystemDirectoryW GetFileType CancelIoEx GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes CreateIoCompletionPort SetUnhandledExceptionFilter InitializeSListHead GetCommandLineW AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW FreeEnvironmentStringsW QueryPerformanceCounter GetEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

crypt32

CertAddCertificateContextToStore CertGetCertificateChain CertDuplicateCertificateChain CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertCloseStore CertOpenStore CertCreateCertificateContext CertFreeCertificateContext CertFreeCertificateChain CertDuplicateStore CertDuplicateCertificateContext

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

ws2_32

setsockopt getsockname WSAGetLastError getpeername WSASend send recv freeaddrinfo getaddrinfo closesocket WSACleanup WSAStartup getsockopt connect bind WSAIoctl ioctlsocket WSASocketW shutdown

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtWriteFile NtOpenFile NtReadFile

secur32

AcceptSecurityContext InitializeSecurityContextW DecryptMessage FreeCredentialsHandle EncryptMessage ApplyControlToken DeleteSecurityContext AcquireCredentialsHandleA FreeContextBuffer QueryContextAttributesW

userenv

GetUserProfileDirectoryW

vcruntime140

memset memcpy memcmp __current_exception_context __CxxFrameHandler3 memmove _CxxThrowException __C_specific_handler __current_exception

api-ms-win-crt-math-l1-1-0

fmod pow ceil __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

exit _exit _seh_filter_exe __p___argc _initterm_e _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _get_initial_narrow_environment __p___argv _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_3c1baa1219de385fc055a3d8b203429a_akira_cobalt-strike_glassworm_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

crypt32

shell32

combase

ws2_32

ntdll

secur32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic