Extracted

• • Target
    2026-06-04_5c218ffbf380896d9f6f4552d62b877c_akira_cobalt-strike_rusty-stealer_satacom
  • Size 560KB
  • SHA256 3128c6f5ff0170356546b2d8a48459a2040c88877e2cba224822429f063f0e6a
  • MD5 5c218ffbf380896d9f6f4552d62b877c
  • SHA1 936b7fd3bcf5206a92cce85e5f3d1380fb1ee457
  • SHA512 fadb6c6658e7205533834077af267beccccf0fcca5167ff84cb74ab52fba2c59bb99a761e1a802213d248ab59db10546954dea2b6ab6aaed41c2301c8e535287
  • SSDEEP 6144:7NpQCBbydSuZ/0NATMFqhpLxdMydS5/LRo08mbn:78MuPTU4Myd4bn
  • TLSH
    T1BDC48352F5257A75E14B88FCC610F9635732BC861B339FA7135633682E3E6F21A38621
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistencespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2