2026-06-25_373440d2f812c8e89c1ed03b6acaef58_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-25_373440d2f812c8e89c1ed03b6acaef58_akira_cobalt-strike_rusty-stealer_satacom
Size 2.0MB
Sample260629-23lbssht7w
SHA256 54550c9a7354a83a939addbfa16f2e931ae9cfe932888e155a752cb3a689d634
MD5 373440d2f812c8e89c1ed03b6acaef58
SHA1 30c22fdcbc546b0dd47f2a001b5505dbfe77f525
SHA512 b0c8a49173a363561c8f59be430b6381846e5182396a7fb167fd8b63d36b8386d95a5f1ea6a944ef9f84e795a3c290815f0d47ddcbf283896e4ff2b4d0ac95b7
SSDEEP 49152:m35e/JMtMqAfyk41ZAbkK0Ile7hGoBrOw6afq:Ic/+tMqAf741ZslohGob6ai
TLSH
T172A523A9BE8196EDD54BC035C386C5B5763A70CD1F10BDFF12A412682E2DEF12E78216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-25_373440d2f812c8e89c1ed03b6acaef58_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-06-25_373440d2f812c8e89c1ed03b6acaef58_akira_cobalt-strike_rusty-stealer_satacom

.exe 2.0MB

2026-06-25_373440d2f812c8e89c1ed03b6acaef58_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 21dc6567228aeba0d3368a48ca558e80
SHA256 54550c9a7354a83a939addbfa16f2e931ae9cfe932888e155a752cb3a689d634
MD5 373440d2f812c8e89c1ed03b6acaef58
SHA1 30c22fdcbc546b0dd47f2a001b5505dbfe77f525
SHA512 b0c8a49173a363561c8f59be430b6381846e5182396a7fb167fd8b63d36b8386d95a5f1ea6a944ef9f84e795a3c290815f0d47ddcbf283896e4ff2b4d0ac95b7
SSDEEP 49152:m35e/JMtMqAfyk41ZAbkK0Ile7hGoBrOw6afq:Ic/+tMqAf741ZslohGob6ai
TLSH
T172A523A9BE8196EDD54BC035C386C5B5763A70CD1F10BDFF12A412682E2DEF12E78216
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

150064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

tester.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW ConnectNamedPipe GetLastError PeekNamedPipe ReadFile CreateNamedPipeW CloseHandle WaitForSingleObject GetExitCodeThread CreateProcessW TerminateProcess FormatMessageW GetProcessHeap HeapFree SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileInformationByHandle GetFileInformationByHandleEx GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW FindFirstFileExW FindClose GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetModuleHandleA GetTempPathW FindNextFileW

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

memcpy memset memcmp memmove __current_exception_context __current_exception __C_specific_handler _CxxThrowException __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _configure_narrow_argv _crt_atexit _initialize_narrow_environment _register_onexit_function _initialize_onexit_table _initterm_e _get_initial_narrow_environment exit terminate _register_thread_local_exe_atexit_callback _initterm _c_exit _exit _cexit __p___argv __p___argc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Name

.text

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fgprnt

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

836B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-25_373440d2f812c8e89c1ed03b6acaef58_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic