2026-05-23_a98163dd6c589ec729d64a57d9455736_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-23_a98163dd6c589ec729d64a57d9455736_akira_cobalt-strike_rusty-stealer_satacom
Size 4.4MB
Sample260523-dv3n4sew21
SHA256 a313416a294f3e620b58365265dd2eb3743d40e3f744bc3f2c58ebd8bc08ed0a
MD5 a98163dd6c589ec729d64a57d9455736
SHA1 d0839c4cdaa7a90209e1b5518772a20a3aad4ddb
SHA512 b5e364ac07b9303eb1bdf9dbacd74b5e1c37c9994b4f6c46e76298210185a649a393342b30152c40d693b8593a6499301e4155af1817408897202b28e562b7f2
SSDEEP 49152:IDOTAmI2m9gEIKo14S2Qge03XMBOhtT/1KHPP9bbKJelrm0NH1g:IDOPm9guoGS26+T3/1KbQ
TLSH
T16C268D03E362D2ECC116D8754715A233EB62BC491B3476EF6FC47A207AA7FD05A28719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-23_a98163dd6c589ec729d64a57d9455736_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-05-23_a98163dd6c589ec729d64a57d9455736_akira_cobalt-strike_rusty-stealer_satacom

.exe 4.4MB

2026-05-23_a98163dd6c589ec729d64a57d9455736_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH cf78baa542eb48b7395228a5a3e6ce7b
SHA256 a313416a294f3e620b58365265dd2eb3743d40e3f744bc3f2c58ebd8bc08ed0a
MD5 a98163dd6c589ec729d64a57d9455736
SHA1 d0839c4cdaa7a90209e1b5518772a20a3aad4ddb
SHA512 b5e364ac07b9303eb1bdf9dbacd74b5e1c37c9994b4f6c46e76298210185a649a393342b30152c40d693b8593a6499301e4155af1817408897202b28e562b7f2
SSDEEP 49152:IDOTAmI2m9gEIKo14S2Qge03XMBOhtT/1KHPP9bbKJelrm0NH1g:IDOPm9guoGS26+T3/1KbQ
TLSH
T16C268D03E362D2ECC116D8754715A233EB62BC491B3476EF6FC47A207AA7FD05A28719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2207808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

kernel32

LoadLibraryA HeapReAlloc GlobalFree GetFileAttributesW GetModuleFileNameW CloseHandle LoadLibraryW FormatMessageW HeapAlloc LoadLibraryExW SetThreadErrorMode FreeLibrary GetLastError GetProcAddress GetCurrentProcessId HeapFree GetProcessHeap GetSystemTimeAsFileTime DuplicateHandle GetModuleHandleA GetComputerNameW PostQueuedCompletionStatus GlobalMemoryStatusEx GetSystemTimePreciseAsFileTime SetHandleInformation CreateIoCompletionPort CreateProcessW GetCurrentThread GlobalUnlock SetWaitableTimer SwitchToThread GlobalLock GlobalSize GetWindowsDirectoryW CreateWaitableTimerExW GlobalAlloc DeleteFileW GetSystemDirectoryW ExitProcess GetQueuedCompletionStatusEx Sleep GetFileInformationByHandleEx GetStdHandle GetConsoleMode GetConsoleOutputCP GetFileInformationByHandle WaitForSingleObject WriteConsoleW WriteFileEx SleepEx ReadFileEx SetLastError GetCurrentThreadId GetModuleHandleW CreateThread GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetCurrentProcess InitializeSListHead SetUnhandledExceptionFilter GetCurrentDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar QueryPerformanceFrequency QueryPerformanceCounter

user32

GetForegroundWindow SetWindowPlacement GetWindowPlacement EnableMenuItem ChangeDisplaySettingsExW FlashWindowEx SetWindowDisplayAffinity SetWindowTextW SetCursorPos GetWindowTextW GetWindowTextLengthW MonitorFromWindow GetWindowRect SetWindowLongW DestroyCursor DestroyIcon GetCursorPos ReleaseCapture MapVirtualKeyW GetKeyboardLayout GetMenu ScreenToClient MonitorFromRect SetCapture TrackMouseEvent GetKeyboardState CreateIcon IsIconic CreateIconFromResourceEx SendMessageW GetActiveWindow GetClientRect SystemParametersInfoA SendInput IsWindowVisible MonitorFromPoint GetMonitorInfoW EnumDisplayMonitors RemovePropW PostMessageW RegisterWindowMessageA RedrawWindow DestroyWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowLongPtrW InvalidateRgn SetWindowPos RegisterRawInputDevices CreateWindowExW RegisterClassExW SetForegroundWindow DefWindowProcW GetSystemMenu GetAsyncKeyState GetKeyState LoadCursorW ClientToScreen IsProcessDPIAware GetClipCursor ClipCursor ShowCursor SetCursor ShowWindow GetWindowLongW GetClassNameW CallWindowProcW SetWindowLongPtrW SetPropW GetPropW AdjustWindowRectEx ToUnicodeEx MsgWaitForMultipleObjectsEx GetClassInfoExW ReleaseDC GetSystemMetrics ValidateRect GetRawInputData GetDC MapVirtualKeyExW CloseTouchInputHandle OpenClipboard RegisterClipboardFormatW IsClipboardFormatAvailable GetClipboardData CloseClipboard EmptyClipboard SetClipboardData RegisterTouchWindow GetTouchInputInfo

gdi32

CreateCompatibleBitmap DeleteDC GetDIBits SelectObject CreateCompatibleDC CreateRectRgn GetDeviceCaps BitBlt DeleteObject ChoosePixelFormat SwapBuffers SetPixelFormat DescribePixelFormat

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaLookupId

oleaut32

VariantClear SetErrorInfo SysStringLen SafeArrayCreateVector SafeArrayPutElement GetErrorInfo SysAllocStringLen

ole32

CoCreateInstance RevokeDragDrop CoUninitialize CoInitializeEx RegisterDragDrop CoCreateFreeThreadedMarshaler OleInitialize

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

ws2_32

recv connect getaddrinfo closesocket WSAGetLastError WSAStartup WSACleanup WSASocketW send freeaddrinfo

secur32

AcquireCredentialsHandleA QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext EncryptMessage DecryptMessage DeleteSecurityContext FreeCredentialsHandle

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertFreeCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertDuplicateStore CertCloseStore

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

RevertToSelf ImpersonateAnonymousToken GetUserNameW RegGetValueW

shlwapi

AssocQueryStringW

shell32

DragFinish DragQueryFileW

opengl32

wglShareLists wglGetCurrentDC wglCreateContext wglGetProcAddress wglGetCurrentContext wglMakeCurrent wglDeleteContext

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

vcruntime140

memcmp __current_exception_context __current_exception __C_specific_handler memset memcpy memmove

api-ms-win-crt-math-l1-1-0

expf _hypotf powf sin cos fmod roundf round acosf cbrtf cosf truncf exp2f floorf pow floor trunc atan2f ceilf __setusermatherr sinf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _configure_narrow_argv _initterm_e exit _exit strerror __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xta

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xha

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xea

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xda

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xva

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.txd

Size

512B

Virtual Size

326B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-23_a98163dd6c589ec729d64a57d9455736_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

user32

gdi32

uiautomationcore

oleaut32

ole32

ntdll

ws2_32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

advapi32

shlwapi

shell32

opengl32

imm32

dwmapi

uxtheme

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic