2026-07-05_f707aa5105f6d8611b4117e5548d94f1_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_f707aa5105f6d8611b4117e5548d94f1_akira_cobalt-strike_rusty-stealer_satacom
Size 3.7MB
Sample260705-dwhekagy81
SHA256 7848477804d7c6390fbdfd0438128890b53ed4041e5fc2e86056d68ba13687d1
MD5 f707aa5105f6d8611b4117e5548d94f1
SHA1 dee56f6c800da94d1d6b2f245c7d2562a5539a8f
SHA512 2f93ccc5a382371fba366125d0f8f67117bc85721f04fd6bdc03f57811eb639f7d9f1ca6f2542afa26849fcd8ad4801d8f9cd71b104a392b7e634367852e8823
SSDEEP 49152:wX+ysuTDzojZ0m1MMKhGxNaoi6Tp+PAkrVBKvcY++BadCsEyBA6g9P5EGxw06C7k:ZyDTDzo7rUNt7C7
TLSH
T12906D816A76960DAC17FC07892878F22BD2170DA07397BF745C1826A2F64EF8AD3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_f707aa5105f6d8611b4117e5548d94f1_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-05_f707aa5105f6d8611b4117e5548d94f1_akira_cobalt-strike_rusty-stealer_satacom

.exe 3.7MB

2026-07-05_f707aa5105f6d8611b4117e5548d94f1_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH e091e9e5125f112e0e60233724b59c5a
SHA256 7848477804d7c6390fbdfd0438128890b53ed4041e5fc2e86056d68ba13687d1
MD5 f707aa5105f6d8611b4117e5548d94f1
SHA1 dee56f6c800da94d1d6b2f245c7d2562a5539a8f
SHA512 2f93ccc5a382371fba366125d0f8f67117bc85721f04fd6bdc03f57811eb639f7d9f1ca6f2542afa26849fcd8ad4801d8f9cd71b104a392b7e634367852e8823
SSDEEP 49152:wX+ysuTDzojZ0m1MMKhGxNaoi6Tp+PAkrVBKvcY++BadCsEyBA6g9P5EGxw06C7k:ZyDTDzo7rUNt7C7
TLSH
T12906D816A76960DAC17FC07892878F22BD2170DA07397BF745C1826A2F64EF8AD3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2783696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

btxgpuminer-2dfdb734c444a1e3.pdb

kernel32

GetConsoleScreenBufferInfo GetStdHandle SetConsoleMode GetConsoleMode CloseHandle SetConsoleTextAttribute GetExitCodeProcess InitializeSListHead GetSystemTimeAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetUnhandledExceptionFilter GetSystemInfo QueryPerformanceCounter GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle DuplicateHandle WaitForSingleObject SetHandleInformation AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetFileInformationByHandleEx SwitchToThread CreateFileW CreateEventW GetOverlappedResult GetFileInformationByHandle FindFirstFileExW FindClose GetFileType GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess WaitForMultipleObjects ReadFileEx SleepEx ReadFile QueryPerformanceFrequency CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtReadFile

userenv

GetUserProfileDirectoryW

ws2_32

connect recv closesocket getaddrinfo WSAGetLastError WSADuplicateSocketW WSASocketW freeaddrinfo setsockopt accept send getsockname bind listen WSAStartup WSACleanup

vcruntime140

__C_specific_handler _CxxThrowException memmove __current_exception memset __CxxFrameHandler3 memcpy __current_exception_context memcmp

api-ms-win-crt-math-l1-1-0

log2 ceil fmod floor __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _initialize_onexit_table _register_onexit_function _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit _c_exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_f707aa5105f6d8611b4117e5548d94f1_akira_cobalt-strike_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

userenv

ws2_32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic