2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom
Size 322KB
Sample260708-e16hmaay2w
SHA256 f16c1e55f922281ec0a242cacd315b31d9600c5f681b650540bf6c040fdfcf75
MD5 8a3a44067277d4ad09a6d4b5b9123f16
SHA1 3c10dc082abd3c664eaffa3f3486b9e2a68c8dc5
SHA512 ecc090bd564426ea19cae123cbc9c9f91c8695314b63d992b4bcd335292e7efdc0fb8d0bc4a2f6d42530f8efa785097a1c5dc1555e22843afb688c46a448e386
SSDEEP 6144:6jyJNre2JHcmszwWkkN97MJhIw07LbK64zysxvDDcH:6jQre2JHU8heXOxvH
TLSH
T192643B15AA5A5CBCD586C874C34A8EA3692174CB0B36E8FF05C515343F6EAF96F38318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom

.exe 322KB

2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 573c6b850aa9cd2668eeeb160bd36ce5
SHA256 f16c1e55f922281ec0a242cacd315b31d9600c5f681b650540bf6c040fdfcf75
MD5 8a3a44067277d4ad09a6d4b5b9123f16
SHA1 3c10dc082abd3c664eaffa3f3486b9e2a68c8dc5
SHA512 ecc090bd564426ea19cae123cbc9c9f91c8695314b63d992b4bcd335292e7efdc0fb8d0bc4a2f6d42530f8efa785097a1c5dc1555e22843afb688c46a448e386
SSDEEP 6144:6jyJNre2JHcmszwWkkN97MJhIw07LbK64zysxvDDcH:6jQre2JHU8heXOxvH
TLSH
T192643B15AA5A5CBCD586C874C34A8EA3692174CB0B36E8FF05C515343F6EAF96F38318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

236272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stub_rust.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

advapi32

FreeSid CheckTokenMembership OpenProcessToken AllocateAndInitializeSid RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

GetTempPathW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter CreateDirectoryW DuplicateHandle GetLastError SwitchToThread FindClose FreeLibrary CloseHandle GetCommandLineW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTickCount GetSystemInfo GlobalMemoryStatusEx GetSystemFirmwareTable IsDebuggerPresent CreateMutexA FindNextFileW FindFirstFileExW CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId SetHandleInformation CreateThread DeleteFileW SetFileInformationByHandle SetFileAttributesW CopyFileExW GetVolumeInformationA LoadLibraryA GetProcAddress AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW

ntdll

RtlNtStatusToDosError NtOpenFile NtWriteFile NtCreateNamedPipeFile

shell32

SHGetFolderPathW ShellExecuteW

ws2_32

send freeaddrinfo connect setsockopt WSADuplicateSocketW WSASocketW WSAStartup WSACleanup closesocket WSAGetLastError recv getaddrinfo

vcruntime140

memset __current_exception _CxxThrowException __current_exception_context memmove memcpy memcmp __CxxFrameHandler3 __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _set_app_type _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _initterm _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_8a3a44067277d4ad09a6d4b5b9123f16_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ntdll

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic