General
- Target 2026-05-03_dafa76881abe09b012e98149383bb463_akira_cobalt-strike_rusty-stealer_satacom
- Size 490KB
- Sample260503-bdrjeady8p
- SHA256 3150dc1caed8c491e9aed7a4379ada72a1c0b64155645ea91bc3d1f57edac99d
Score
10/10
Malware Config
Targets
-
- Target 2026-05-03_dafa76881abe09b012e98149383bb463_akira_cobalt-strike_rusty-stealer_satacom
- Size 490KB
- SHA256 3150dc1caed8c491e9aed7a4379ada72a1c0b64155645ea91bc3d1f57edac99d
Score10/10-
Detects UnixStealer payload
-
Family: UnixStealer
UnixStealer is a Windows stealer written in C#.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing commands for clearing Windows Event Logs
-
Detects executables referencing Discord tokens regular expressions
-
Detects executables referencing credit card regular expressions
-
Detects executables referencing many VPN software clients. Observed in infosteslers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Detects executables referencing virtualization MAC addresses
-
Detects executables using Telegram Chat Bot
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.