2026-09-27_13750262fee783f63706ef104391d1f2_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom
Browser credential stealer with C2
Browser credential theft process killingUnsigned Winsock loader with debugger-gated PE
SHA-2563905b3e976b8bef8253bf4914bd3fa328b925d20cf440a17ea01f022d7ac2c94
Evidence
⋯7 more rows
0x3f000000000000000000000000000000000................
0x40056574883ec384889ce488b014889c148VWH..8H..H..H..H
0x410f7d9713d488b7e104885ff0f84220100..q=H.~.H...."..
0x42000488b7618488b064885c074054889f9.H.v.H..H..t.H..
0x430ffd0488b56084885d20f84040100004c..H.V.H........L
0x4408b46104889f94883c4385f5ee98f8e07.F.H..H..8_^....
0x450007314488b4e0848c744242801000000.s.H.N.H.D$(....
0x460488d542430eb05488d5424284889024cH.T$0..H.T$(H..L
0x4708b4424284d85c0740f488b5424304885.D$(M..t.H.T$0H.
0x480d27405e8588e0700488b46184885c074.t..X...H.F.H..t
0x49014488b4e2048c744242801000000488d.H.N H.D$(....H.
0x4a0542430eb05488d5424284889024c8b44T$0..H.T$(H..L.D
0x4b024284d85c0740f488b5424304885d274$(M..t.H.T$0H..t
0x4c005e81a8e0700488b46304885c0741448......H.F0H..t.H
0x4d08b4e3848c744242801000000488d5424.N8H.D$(....H.T$
0x4e030eb05488d5424284889024c8b4424280..H.T$(H..L.D$(
0x4f04d85c0740f488b5424304885d27405e8M..t.H.T$0H..t..
0x500dc8d0700488b46484885c07414488b4e....H.FHH..t.H.N
0x5105048c744242801000000488d542430ebPH.D$(....H.T$0.
0x52005488d5424284889024c8b4424284d85.H.T$(H..L.D$(M.
0x530c07410488b5424304885d27406e89e8d.t.H.T$0H..t....
0x5400700904883c4385f5ec3cccccccccccc...H..8_^.......
0x55056574883ec380fb6411885c0747883f8VWH..8..A...tx..
0x56003744683f8040f85ee000000488d4150.tF.........H.AP
0x5704889ce4889c1e8d52600004889f0837eH..H....&..H...~
0x58028000f84b7000000488b50404885d20f(.......H.P@H...
0x590848000000048c1e20548c74424280400.....H...H.D$(..
0x5a000004c8d442430eb7366837920030f85..L.D$0.sf.y ...
0x5b0a6000000488b71284889f1e8e0fe1500....H.q(H.......
0x5c084c00f84920000004889f14883c4385f........H..H..8_
0x5d05ee9fa041600488b014885c07414488b^.....H..H..t.H.
0x5e0490848c744242801000000488d542430I.H.D$(....H.T$0
0x5f0eb05488d5424284889024c8b4424284d..H.T$(H..L.D$(M
0x60085c07456488b5424304885d2744ce8cd..tVH.T$0H..tL..
0x6108c0700eb454c8d44242831d2488b4830....EL.D$(1.H.H0
0x6204989104c8b4424284d85c07412488b54I..L.D$(M..t.H.T
0x63024304885d27408e8a48c07004889f048$0H..t......H..H
0x6408b70204885f6741289f083e0038d48fe.p H..t.......H.
0x65083f90272054885c075074883c4385f5e...r.H..u.H..8_^
0x660c3488b7e0748ffce488b074885c07405.H.~.H..H..H..t.
0x670488b0effd0488b57084885d2740c4c8bH....H.W.H..t.L.
0xb0ec8b490848c744242801000000488d5424.I.H.D$(....H.T$
0xb0fc30eb05488d5424284889024c8b4424280..H.T$(H..L.D$(
0xb10c4d85c07410488b5424304885d27406e8M..t.H.T$0H..t..
0xb11cc0e10600904883c4385f5ec3cccccccc.....H..8_^.....
0xb12ccccccccc564883ec204889ce31c0483b....VH.. H..1.H;
0xb13c027146e8cce10600b918000000ba0100.qF.............
0xb14c0000e87de106004885c074440f100519...}...H..tD....
0xb15c343a000f110048b9486f73745461736b4:....H.HostTask
0xb16c4889481048c706180000004889460848H.H.H......H.F.H
0xb17cc7461018000000eb0e488b4210488946.F.......H.B.H.F
0xb18c100f10020f11064889f04883c4205ec3.......H..H.. ^.
0xb19cb901000000ba18000000e8b0053a000f.............:..
0xb1ac0bcccccc564883ec204889ce31c0483b....VH.. H..1.H;
0xb1bc02713fe84ce10600b913000000ba0100.q?.L...........
0xb1cc0000e8fde006004885c0743d0f100586.......H..t=....
0xb1ec130000004889460848c7461013000000....H.F.H.F.....
0xb1fceb0e488b4210488946100f10020f1106..H.B.H.F.......
0xb20c4889f04883c4205ec3b901000000ba13H..H.. ^........
0xb21c000000e837053a000f0bcccccccccccc....7.:.........
0xb22ccccccccc564883ec204889ce31c0483b....VH.. H..1.H;
0xb23c027142e8cce00600b90b000000ba0100.qB.............
0xb26c48c7060b0000004889460848c746100bH......H.F.H.F..
0xb27c000000eb0e488b4210488946100f1002.....H.B.H.F....
0xb28c0f11064889f04883c4205ec3b9010000...H..H.. ^.....
0xb29c00ba0b000000e8b4043a000f0bcccccc.........:......
0xb2accccccccc564883ec204889ce31c0483b....VH.. H..1.H;
0xb2bc027149e84ce00600b90e000000ba0100.qI.L...........
0xb2cc0000e8fddf06004885c0744748b97353.......H..tGH.sS
0xb2dc7973486f73744889480648b957696e64ysHostH.H.H.Wind
0xb2ec6f77735348890848c7060e0000004889owsSH..H......H.
0xb2fc460848c746100e000000eb0e488b4210F.H.F.......H.B.
0xb30c488946100f10020f11064889f04883c4H.F.......H..H..
0xb31c205ec3b901000000ba0e000000e82d04 ^............-.
0xb32c3a000f0b564883ec204889ce31c0483b:...VH.. H..1.H;
0xb33c027146e8ccdf0600b915000000ba0100.qF.............
0xb34c0000e87ddf06004885c074440f1005f1...}...H..tD....
0xb35c313a000f110048b9727946696c7465721:....H.ryFilter
0xb36c4889480d48c706150000004889460848H.H.H......H.F.H
0xb37cc7461015000000eb0e488b4210488946.F.......H.B.H.F
0xb38c100f10020f11064889f04883c4205ec3.......H..H.. ^.
0xb39cb901000000ba15000000e8b0033a000f.............:..
0xb3ac0bcccccc4883ec684889d0488d511848....H..hH..H.Q.H
0xb3bc89542460488d15212a3a004889542450.T$`H..!*:.H.T$P
0xb3cc488d5424604889542448488d15372a3aH.T$`H.T$HH..7*:
0xb3dc004889542438488d15df293a00488954.H.T$8H...):.H.T
0x10de14ccbffffc6030341c6060341c6042403L......A...A..$.
0x10df14889ee41c6450003b005488b8c249800H..A.E....H..$..
0x10e0100008801b109e925cbffffb10ce91ecb.......%........
0x10e11ffff488d0dccec39004c8d0537ed3900..H....9.L..7.9.
0x10e21ba1f000000e825ab39000f0b4889f9e8......%.9...H...
0x10e31bb923900e947cbffffe8219e390089c3..9..G....!.9...
0x10e4180f301e950cbffff4889bc24b0090000....P...H..$....
0x10e51889c24b8090000488d0529d33900e9c7..$....H..).9...
0x10e610100004889f9e844933900e969cbffff...H...D.9..i...
0x10e71488b0de0954300488d9424e0030000e8H....C.H..$.....
0x10e81df543800e9a3dbffff4c8d0df7e53900.T8......L....9.
0x10e914889d14c89f24989d8e8a1ad39000f0bH..L..I.....9...
0x10ea1488d0d98cc3900e8e3aa39000f0b H....9....9...
⋯5 more rows
0x3ad020882b3940010000000000000000000000.+9@............
0x3ad030000000000000000050fe1a4001000000........P..@....
0x3ad04000000000000000000000000000000000................
0x3ad06058863840010000000000000000000000X.8@............
0x3ad07000000000000000000000000000000000................
0x3ad0804a6f696e48616e646c6520706f6c6c65JoinHandle polle
0x3ad0906420616674657220636f6d706c657469d after completi
0x3ad0a06f6e433a5c55736572735c313233345conC:\Users\1234\
0x3ad0b02e636172676f5c72656769737472795c.cargo\registry\
0x3ad0c07372635c696e6465782e637261746573src\index.crates
0x3ad0d02e696f2d313934396366386336623562.io-1949cf8c6b5b
0x3ad0e0353537665c746f6b696f2d312e35332e557f\tokio-1.53.
0x3ad0f0315c7372635c72756e74696d655c74611\src\runtime\ta
0x3ad100736b5c636f72652e7273000000000000sk\core.rs......
0x3ad110a2dc3a40010000006800000000000000..:@....h.......
0x3ad120ab010000160000003f36c5ffa135c5ff........?6...5..
0x3ad130a135c5fff035c5ffcc35c5ffcc35c5ff.5...5...5...5..
0x3ad140cc35c5ffcc35c5ffcc35c5ffcc35c5ff.5...5...5...5..
0x3ad1504436c5ff4e38c5ff0236c5fff135c5ffD6..N8...6...5..
0x3ad1601637c5fff135c5ff8636c5ff8636c5ff.7...5...6...6..
0x3ad1702136c5ff2136c5ff5e39c5ff5e39c5ff!6..!6..^9..^9..
0x3ad1805e39c5ff5e39c5ff713cc5ff003cc5ff^9..^9..q<...<..
0x3ad190003cc5ff003cc5ff003cc5ff513cc5ff.<...<...<..Q<..
0x3ad1a0c838c5ffc838c5ffc838c5ffc838c5ff.8...8...8...8..
0x3ad1b0193ac5ff0c3dc5ff4b3dc5ff4b3dc5ff.:...=..K=..K=..
0x3ad1c0d73cc5fffa3cc5ffe83cc5ff474fc5ff.<...<...<..GO..
0x3ad1d02c50c5ff314fc5ff314fc5ffa94fc5ff,P..1O..1O...O..
0x3ad1e0314fc5ff314fc5ff474fc5ff9b50c5ff1O..1O..GO...P..
0x3ad1f06b4fc5ff314fc5ff314fc5ff8a4fc5ffkO..1O..1O...O..
0x3ad2006350c5ff1769c5ff836ac5ff056bc5ffcP...i...j...k..
0x3ad2106f6ac5fff56ac5ff446ac5ff5f6ac5ffoj...j..Dj.._j..
0x3ad220736ac5ff316bc5ffda6bc5ff436cc5ffsj..1k...k..Cl..
0x3ad230c96bc5ff336cc5ffa26bc5ffb96bc5ff.k..3l...k...k..
0x3ad240ce6bc5ff716cc5ff1a6dc5ff836dc5ff.k..ql...m...m..
0x3ad250096dc5ff736dc5ffe26cc5fff96cc5ff.m..sm...l...l..
0x3ad2600e6dc5ffb96dc5ffc66ec5ff486fc5ff.m...m...n..Ho..
0x3ad270b26ec5ff386fc5ff876ec5ffa26ec5ff.n..8o...n...n..
0x3ad280b66ec5ff896fc5ff9670c5ff1871c5ff.n...o...p...q..
0x3ad2908270c5ff0871c5ff5770c5ff7270c5ff.p...q..Wp..rp..
⋯3 more rows
0x3c0e5a4452495645484f4d4550415448c0c000DRIVEHOMEPATH...
0x3c0e6a476f6f676c65204368726f6d65476f6fGoogle ChromeGoo
0x3c0e7a676c655c4368726f6d655c5573657220gle\Chrome\User
0x3c0e8a446174615c4c6f63616c205374617465Data\Local State
0x3c0e9a476f6f676c655c4368726f6d655c5573Google\Chrome\Us
0x3c0eaa657220446174615c44656661756c745cer Data\Default\
0x3c0eba4c6f67696e20446174614d6963726f73Login DataMicros
0x3c0eca6f667420456467654d6963726f736f66oft EdgeMicrosof
0x3c0eda745c456467655c557365722044617461t\Edge\User Data
0x3c0eea5c4c6f63616c2053746174654d696372\Local StateMicr
0x3c0efa6f736f66745c456467655c5573657220osoft\Edge\User
0x3c0f0a446174615c44656661756c745c4c6f67Data\Default\Log
0x3c0f1a696e2044617461427261766542726176in DataBraveBrav
0x3c0f2a65536f6674776172655c42726176652deSoftware\Brave-
0x3c0f3a42726f777365725c5573657220446174Browser\User Dat
0x3c0f4a615c4c6f63616c205374617465427261a\Local StateBra
0x3c0f5a7665536f6674776172655c4272617665veSoftware\Brave
0x3c0f6a2d42726f777365725c55736572204461-Browser\User Da
0x3c0f7a74615c44656661756c745c4c6f67696eta\Default\Login
0x3c0f8a2044617461566976616c646956697661 DataVivaldiViva
0x3c0f9a6c64695c5573657220446174615c4c6fldi\User Data\Lo
0x3c0faa63616c205374617465566976616c6469cal StateVivaldi
0x3c0fba5c5573657220446174615c4465666175\User Data\Defau
0x3c0fca6c745c4c6f67696e204461746159616elt\Login DataYan
0x3c0fda64657859616e6465785c59616e646578dexYandex\Yandex
0x3c0fea42726f777365725c5573657220446174Browser\User Dat
0x3c0ffa615c4c6f63616c20537461746559616ea\Local StateYan
0x3c100a6465785c59616e64657842726f777365dex\YandexBrowse
0x3c101a725c5573657220446174615c44656661r\User Data\Defa
0x3c102a756c745c4c6f67696e20446174614f70ult\Login DataOp
0x3c103a6572614f7065726120536f6674776172eraOpera Softwar
0x3c104a655c4f7065726120537461626c655c4ce\Opera Stable\L
0x3c105a6f63616c2053746174654f7065726120ocal StateOpera
0x3c106a536f6674776172655c4f706572612053Software\Opera S
0x3c107a7461626c655c44656661756c745c4c6ftable\Default\Lo
0x3c108a67696e20446174614f70657261204758gin DataOpera GX
0x3c109a4f7065726120536f6674776172655c4fOpera Software\O
0x3c10aa7065726120475820537461626c655c4cpera GX Stable\L
0x3c10ba6f63616c2053746174654f7065726120ocal StateOpera
0x3c10ca536f6674776172655c4f706572612047Software\Opera G
0x3c10da5820537461626c655c44656661756c74X Stable\Default
0x3c10ea5c4c6f67696e20446174610000006a1a\Login Data...j.
0x3c10fa3c40010000000d00000000000000771a<@............w.
0x3c110a3c400100000023000000000000009a1a<@....#.........
0x3c111a3c40010000002a00000000000000c41a<@....*.........