Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 16:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_7ff85bb9c2bb7c9ee9b604d50f772af9_akira_cobalt-strike_glassworm_satacom_stealc_vidar.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_7ff85bb9c2bb7c9ee9b604d50f772af9_akira_cobalt-strike_glassworm_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-11-01_7ff85bb9c2bb7c9ee9b604d50f772af9_akira_cobalt-strike_glassworm_satacom_stealc_vidar.exe
- Size 1.1MB
- Sample261102-t4859aff64
- SHA256 1d2c8f5485d7086102a9c7a91b3e6111dc850be23c9d22f85615fd9ae8350b89
- MD5 7ff85bb9c2bb7c9ee9b604d50f772af9
- SHA1 2ca1a9c77c4bffa8e40d835a3fc78b66a9510cfb
- SHA512 bb9f894724bf8edba2004e99f6f759259862e9921e3279842018fd5c7fe43bf6cb73cd447a10d1ca7e6a790ced557cf326fddc9c3358312611c7ec8e1735a241
- SSDEEP 24576:/+BtfJwQj5Nesi2SPfgw0WDJBwTtlGa7PbnNDWc9JtGj:/+jJ5j1P8fgyDJBwTtlGa7bE
- TLSH T1CA355C5AA7A901E4C1BBC07CC543621BF9B1745543309BD71BA1DB672F23BE4AA3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-01_7ff85bb9c2bb7c9ee9b604d50f772af9_akira_cobalt-strike_glassworm_satacom_stealc_vidar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-01_7ff85bb9c2bb7c9ee9b604d50f772af9_akira_cobalt-strike_glassworm_satacom_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_7ff85bb9c2bb7c9ee9b604d50f772af9_akira_cobalt-strike_glassworm_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_7ff85bb9c2bb7c9ee9b604d50f772af9_akira_cobalt-strike_glassworm_satacom_stealc_vidar.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
PID:6112