2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom
Size 20.2MB
Sample261030-14s8cssshz
SHA256 a369178600db931ba584b63ed3a88c5e9dec4f2eed1f87ca4450f2b1c4951091
MD5 910460a6c8ddd2e9ef314e3d74d24ae7
SHA1 8663568aec59716595e558fc83b6b6245c4d443f
SHA512 d5888e48008e342356297e4723dad7b304fc56da5e6d86f71fff0ccf023e19700f4cec24437d43654d6cc0d8528138102a70cb765faee4ad2654dc5a5dbb1034
SSDEEP 98304:gfDG3PePLiEJsjsFQx6eWEhqloNtLOM1kILrDo5/caSwXwL99ylbf+ZNNVS0i+WZ:YfJsSo6eRx1kUS/caSwX8ZNNVSrF
TLSH
T17127F6217A5B99ACD19AC87083468A721E6130DB1B36B9FF44D452393F6DBF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

File Explorer

2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

.exe 20.2MB

2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

IMPHASH 10f8692eaf3f0f93cff831a69a94caea
SHA256 a369178600db931ba584b63ed3a88c5e9dec4f2eed1f87ca4450f2b1c4951091
MD5 910460a6c8ddd2e9ef314e3d74d24ae7
SHA1 8663568aec59716595e558fc83b6b6245c4d443f
SHA512 d5888e48008e342356297e4723dad7b304fc56da5e6d86f71fff0ccf023e19700f4cec24437d43654d6cc0d8528138102a70cb765faee4ad2654dc5a5dbb1034
SSDEEP 98304:gfDG3PePLiEJsjsFQx6eWEhqloNtLOM1kILrDo5/caSwXwL99ylbf+ZNNVS0i+WZ:YfJsSo6eRx1kUS/caSwX8ZNNVSrF
TLSH
T17127F6217A5B99ACD19AC87083468A721E6130DB1B36B9FF44D452393F6DBF46F38318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14674256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Dorion.pdb

kernel32

FindNextFileW CancelIo GetTempPathW FormatMessageW GlobalMemoryStatusEx K32GetPerformanceInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW DeleteFileW GetFinalPathNameByHandleW CreateMutexA WaitForSingleObjectEx ExitProcess FindFirstFileExW CopyFileExW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx FreeLibrary CreateDirectoryW WaitForMultipleObjects DuplicateHandle GetCurrentProcess TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetProcAddress CreateEventW OpenProcess GetSystemTimes GetTimeZoneInformationForYear GetFullPathNameW SetLastError GetProcessId CreateFileW GetSystemInfo Sleep SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CreateIoCompletionPort CancelIoEx WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult LocalAlloc FlushFileBuffers QueryPerformanceCounter QueryPerformanceFrequency ReadFileEx SleepEx WriteFileEx LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime VirtualQueryEx LoadLibraryExW OutputDebugStringW OutputDebugStringA CreateMutexW ReadProcessMemory MultiByteToWideChar WideCharToMultiByte CompareStringOrdinal CreateThread ReleaseMutex InitializeSListHead LCIDToLocaleName GetUserDefaultUILanguage LoadLibraryExA GetProcessTimes lstrlenW SetUnhandledExceptionFilter SetHandleInformation GetModuleHandleW RtlUnwindEx GetCurrentThreadId RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue GetProcessHeap GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleFileNameW GetStdHandle FlsFree GetCurrentProcessId EncodePointer SwitchToThread GetModuleHandleA CreatePipe GetTickCount GetExitCodeProcess GetLastError WaitForSingleObject FindClose LoadLibraryA HeapReAlloc InitializeCriticalSectionEx CreateNamedPipeW SetNamedPipeHandleState ConnectNamedPipe DisconnectNamedPipe LoadLibraryW HeapAlloc CloseHandle HeapFree GetProcessIoCounters DeleteCriticalSection GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW SetEnvironmentVariableW

advapi32

RegCloseKey SetSecurityDescriptorGroup CopySid GetSidSubAuthorityCount IsValidSid AddAce GetAce InitializeAcl RegOpenKeyExW RegQueryValueExW SetSecurityDescriptorOwner GetLengthSid SetSecurityDescriptorSacl SetSecurityDescriptorDacl RegGetValueW GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyTransactedW RegDeleteTreeW RegDeleteValueW RegCreateKeyTransactedW FreeSid RegSetValueExW GetSecurityDescriptorControl SetSecurityDescriptorControl RegCreateKeyExW GetSidLengthRequired GetTokenInformation SystemFunction036 OpenProcessToken GetAclInformation EventUnregister EventSetInformation EventRegister EventWriteTransfer

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

oleaut32

GetErrorInfo SysStringLen SetErrorInfo SysFreeString

shell32

SHGetStockIconInfo DragFinish Shell_NotifyIconGetRect SetCurrentProcessExplicitAppUserModelID Shell_NotifyIconW DragQueryFileW SHGetKnownFolderPath CommandLineToArgvW SHAppBarMessage ShellExecuteExW ShellExecuteW ord155 ord190 SHOpenFolderAndSelectItems

ole32

CoTaskMemFree CoInitialize OleInitialize RegisterDragDrop CoIncrementMTAUsage CoCreateFreeThreadedMarshaler RevokeDragDrop CoTaskMemAlloc CoUninitialize CoCreateInstance CoInitializeEx PropVariantClear

shlwapi

SHCreateMemStream SHStrDupW

ntdll

RtlGetVersion RtlNtStatusToDosError NtQueryInformationProcess NtCreateNamedPipeFile NtCreateFile NtOpenFile NtWriteFile NtReadFile NtDeviceIoControlFile NtCancelIoFileEx

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

ws2_32

bind setsockopt ioctlsocket WSASocketW WSASend recv getsockopt shutdown send getaddrinfo getsockname getpeername accept WSAStartup WSACleanup listen freeaddrinfo WSAIoctl closesocket connect WSAGetLastError

secur32

DeleteSecurityContext FreeCredentialsHandle ApplyControlToken FreeContextBuffer AcquireCredentialsHandleA AcceptSecurityContext InitializeSecurityContextW DecryptMessage EncryptMessage QueryContextAttributesW

psapi

GetModuleFileNameExW GetProcessMemoryInfo

pdh

PdhCloseQuery PdhOpenQueryW PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhEnumObjectsA PdhOpenQueryA PdhCollectQueryData PdhRemoveCounter PdhEnumObjectsW

powrprof

CallNtPowerInformation

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

crypt32

CertFreeCertificateContext CertOpenStore CertFreeCertificateChain CertDuplicateStore CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertEnumCertificatesInStore CertGetCertificateChain CertVerifyCertificateChainPolicy

user32

GetAsyncKeyState ToUnicodeEx GetKeyboardLayout GetClipCursor ClipCursor ShowCursor GetMenu MsgWaitForMultipleObjectsEx RegisterWindowMessageA GetSystemMenu SetWindowLongW GetWindowTextLengthW GetWindowTextW SetWindowTextW SetPropW LoadImageW GetIconInfo GetMessageW MapVirtualKeyW SetWindowRgn FindWindowExW GetParent IsWindowEnabled SetForegroundWindow RegisterClassW ChangeWindowMessageFilterEx KillTimer SetTimer BeginPaint EnableWindow IsIconic IsWindowVisible EnumChildWindows DispatchMessageA EndPaint CloseWindow SendMessageA SendInput GetWindow SetFocus SetParent AdjustWindowRect DestroyAcceleratorTable EnumDisplayMonitors MonitorFromPoint SetMenu CreateMenu CreateWindowExW RegisterClassExW GetTouchInputInfo CloseTouchInputHandle SetWindowPos LoadCursorW PostMessageW RegisterTouchWindow SendMessageW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW MapVirtualKeyExW DefWindowProcW GetRawInputData MonitorFromWindow GetCursorPos SystemParametersInfoW SetCursor MonitorFromRect RedrawWindow DestroyWindow TrackMouseEvent SetCapture ReleaseCapture FillRect GetSystemMetrics SetWindowLongPtrW SetMenuItemInfoW ClientToScreen GetClientRect GetWindowLongW ScreenToClient PostThreadMessageW EnumWindows GetKeyState ChangeDisplaySettingsExW CreatePopupMenu GetMonitorInfoW GetWindowLongPtrW GetLastInputInfo RemoveMenu SetWindowPlacement GetWindowPlacement InvalidateRgn GetWindowRect SetCursorPos GetKeyboardState InvalidateRect SetWindowDisplayAffinity UpdateWindow GetActiveWindow FlashWindowEx GetForegroundWindow GetDoubleClickTime DrawTextW FindWindowW GetWindowThreadProcessId GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo AllowSetForegroundWindow TranslateAcceleratorW IsProcessDPIAware SetWindowsHookExW CreateIcon VkKeyScanW DestroyMenu ShowWindow PostQuitMessage AppendMenuW SystemParametersInfoA TrackPopupMenu DestroyIcon UnhookWindowsHookEx ValidateRect DrawIconEx InsertMenuW CallNextHookEx ReleaseDC CreateAcceleratorTableW GetDC GetMenuItemInfoW EnableMenuItem AdjustWindowRectEx GetMessageA CheckMenuItem DrawMenuBar RegisterRawInputDevices

gdi32

CreatePen TextOutW SetBkColor GetDIBits CombineRgn BitBlt LineTo MoveToEx SetTextColor CreateRectRgn SetBkMode GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush SelectObject CreateDIBSection CreateFontW CreateCompatibleDC

bcrypt

BCryptGenRandom

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

winmm

PlaySoundW

api-ms-win-crt-math-l1-1-0

trunc __setusermatherr roundf round floor pow

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen wcscmp strcpy_s wcslen

api-ms-win-crt-heap-l1-1-0

malloc free calloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_c_exit _initialize_onexit_table _crt_atexit _register_thread_local_exe_atexit_callback _cexit __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _register_onexit_function _seh_filter_exe abort terminate __p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_910460a6c8ddd2e9ef314e3d74d24ae7_akira_cobalt-strike_glassworm_quasar-rat_rusty-stealer_satacom

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

oleaut32

shell32

ole32

shlwapi

ntdll

comctl32

ws2_32

secur32

psapi

pdh

powrprof

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

crypt32

user32

gdi32

bcrypt

imm32

dwmapi

winmm

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic