2026-10-30_ceca0128d5adc3e6fd9b343fbc3a34b9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_ceca0128d5adc3e6fd9b343fbc3a34b9_akira_cobalt-strike_glassworm_rusty-stealer_satacom
Size 17.4MB
Sample261030-t2l8psex2q
SHA256 ba80fc37c100a69639b4a9d86735699707c35ced363648aff4f747c6fcaf78d1
MD5 ceca0128d5adc3e6fd9b343fbc3a34b9
SHA1 18a3aaa465df10068c02148f87c3c9c1d2a328c6
SHA512 f47e07ae81d0050d84b254a19988185e09019677930bec06315253c8737c3104259a3f7f825ff3e6652b1f48fca2da2ee70698ca3ab6a8e3e7b91efafd40f23e
SSDEEP 196608:ry33tjED6xgTY7Icbzzv7sdIjAYRt2ysfRc29UUcYyA2T3H0F:GYWWYswEdcP2rMUcY72DH
TLSH
T18F07D043F292D2FCC015C074D24662B3FAA6BC490B3575EBABC44A217E71EE0DA39756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_ceca0128d5adc3e6fd9b343fbc3a34b9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

File Explorer

2026-10-30_ceca0128d5adc3e6fd9b343fbc3a34b9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

.exe 17.4MB

2026-10-30_ceca0128d5adc3e6fd9b343fbc3a34b9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

IMPHASH b6f5d1a7a1ed11072a575f888ce5e624
SHA256 ba80fc37c100a69639b4a9d86735699707c35ced363648aff4f747c6fcaf78d1
MD5 ceca0128d5adc3e6fd9b343fbc3a34b9
SHA1 18a3aaa465df10068c02148f87c3c9c1d2a328c6
SHA512 f47e07ae81d0050d84b254a19988185e09019677930bec06315253c8737c3104259a3f7f825ff3e6652b1f48fca2da2ee70698ca3ab6a8e3e7b91efafd40f23e
SSDEEP 196608:ry33tjED6xgTY7Icbzzv7sdIjAYRt2ysfRc29UUcYyA2T3H0F:GYWWYswEdcP2rMUcY72DH
TLSH
T18F07D043F292D2FCC015C074D24662B3FAA6BC490B3575EBABC44A217E71EE0DA39756
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4526120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nerestpc_loader.pdb

advapi32

AdjustTokenPrivileges GetUserNameW ImpersonateAnonymousToken LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf SystemFunction036

kernel32

AddVectoredExceptionHandler CancelIo CancelIoEx CloseHandle CompareStringOrdinal CreateDirectoryW CreateEventA CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushViewOfFile FormatMessageW FreeEnvironmentStringsW FreeLibrary GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemFirmwareTable GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetUserPreferredUILanguages GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeSListHead LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess PostQueuedCompletionStatus Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReadProcessMemory ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEvent SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadErrorMode SetThreadPriority SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx WriteProcessMemory lstrlenW

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

oleaut32

GetErrorInfo SysFreeString SysStringLen

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv select send setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

user32

AdjustWindowRectEx ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CloseTouchInputHandle CreateIcon CreateIconFromResourceEx CreateWindowExW DefWindowProcW DestroyCursor DestroyIcon DestroyWindow DispatchMessageW EmptyClipboard EnableMenuItem EnumDisplayDevicesW EnumDisplayMonitors FindWindowW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClassInfoExW GetClassNameW GetClientRect GetClipCursor GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMonitorInfoW GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRgn IsClipboardFormatAvailable IsIconic IsProcessDPIAware LoadCursorW MapVirtualKeyExW MapVirtualKeyW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostMessageW RedrawWindow RegisterClassExW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC ScreenToClient SendInput SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA ToUnicodeEx TrackMouseEvent TranslateMessage ValidateRect

shlwapi

AssocQueryStringW

gdi32

ChoosePixelFormat CreateRectRgn DeleteObject DescribePixelFormat GetDeviceCaps SetPixelFormat SwapBuffers

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

shell32

DragFinish DragQueryFileW ShellExecuteExW

comdlg32

GetOpenFileNameW

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

uxtheme

SetWindowTheme

opengl32

wglCreateContext wglDeleteContext wglGetCurrentContext wglGetCurrentDC wglGetProcAddress wglMakeCurrent wglShareLists

vcruntime140

__C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr _hypotf acosf atan2f cbrtf ceilf cos cosf exp2 exp2f expf floor floorf pow powf round roundf sin sinf trunc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

strlen

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reioc

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

553B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp00

Size

9.0MB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_ceca0128d5adc3e6fd9b343fbc3a34b9_akira_cobalt-strike_glassworm_rusty-stealer_satacom

advapi32

kernel32

ntdll

oleaut32

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

user32

shlwapi

gdi32

ole32

shell32

comdlg32

imm32

uxtheme

opengl32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic