2026-07-10_15eeefb6f8eda0ac042821560c2f603f_akira_cobalt-strike_coinminer_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_15eeefb6f8eda0ac042821560c2f603f_akira_cobalt-strike_coinminer_rusty-stealer_satacom
Size 1.3MB
Sample260710-mp3xcsay4x
SHA256 baa57067fde3f2d30f0b7a0a1567e2f28f316febeaca44154305639c86343536
MD5 15eeefb6f8eda0ac042821560c2f603f
SHA1 0c3fd8fd5c3ceed2812ff43ffa2e2c3398211188
SHA512 9964155c5ae6e6ee063519629dfb67c4fbcb1caa97975591d8b075d2950c48b79c10169c35dd221ed7be64d54e6b57805a355fd6a920f0ec08cc16f2251dc8bd
SSDEEP 24576:BJMuSsX3jmcX6acg6KTtkMy+6FM3VIH06iyq:oXsnKcX6aQKTtFFkYIU6i
TLSH
T189557C47E66581F8C5AEC07CC757A536FA2278894B34A2EB27D04B053E26FD0AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_15eeefb6f8eda0ac042821560c2f603f_akira_cobalt-strike_coinminer_rusty-stealer_satacom

File Explorer

2026-07-10_15eeefb6f8eda0ac042821560c2f603f_akira_cobalt-strike_coinminer_rusty-stealer_satacom

.exe 1.3MB

2026-07-10_15eeefb6f8eda0ac042821560c2f603f_akira_cobalt-strike_coinminer_rusty-stealer_satacom

IMPHASH 88aa0879f38b11fa6f3a1752dac403d1
SHA256 baa57067fde3f2d30f0b7a0a1567e2f28f316febeaca44154305639c86343536
MD5 15eeefb6f8eda0ac042821560c2f603f
SHA1 0c3fd8fd5c3ceed2812ff43ffa2e2c3398211188
SHA512 9964155c5ae6e6ee063519629dfb67c4fbcb1caa97975591d8b075d2950c48b79c10169c35dd221ed7be64d54e6b57805a355fd6a920f0ec08cc16f2251dc8bd
SSDEEP 24576:BJMuSsX3jmcX6acg6KTtkMy+6FM3VIH06iyq:oXsnKcX6aQKTtFFkYIU6i
TLSH
T189557C47E66581F8C5AEC07CC757A536FA2278894B34A2EB27D04B053E26FD0AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

833408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

xmrminer.pdb

kernel32

GetLastError CreateDirectoryW GetSystemInfo GetLogicalProcessorInformation GetCurrentProcess SetProcessInformation GetTickCount GetModuleHandleW GetProcAddress GetSystemTimes SwitchToThread WaitForSingleObject AddVectoredExceptionHandler Sleep GetModuleHandleA GetCurrentThreadId GetConsoleMode GetConsoleOutputCP GetStdHandle MultiByteToWideChar WriteConsoleW FlsAlloc FlsFree FlsSetValue GetProcessHeap HeapReAlloc HeapFree HeapAlloc IsThreadAFiber SetLastError GetEnvironmentVariableW CreateThread GetCurrentThread SetThreadStackGuarantee ReadFileEx SleepEx WriteFileEx CompareStringOrdinal FormatMessageW CreateFileW SetFileTime SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW CreateMutexW QueryPerformanceFrequency QueryPerformanceCounter SetHandleInformation GetSystemTimePreciseAsFileTime DuplicateHandle ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetFileAttributesW GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW WaitForMultipleObjects GetExitCodeProcess CreateProcessW CopyFileExW CreateWaitableTimerExW SetWaitableTimer GetProcessTimes CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters OpenProcess ReadProcessMemory LocalFree VirtualQueryEx InitializeCriticalSectionEx EncodePointer FlsGetValue RtlUnwindEx RaiseException RtlPcToFileHeader SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId FindClose CloseHandle DeleteCriticalSection GetLargePageMinimum VirtualFree VirtualProtect VirtualAlloc

shell32

SHQueryUserNotificationState CommandLineToArgvW

ws2_32

WSAGetLastError WSASocketW WSAStartup ioctlsocket WSARecv getpeername getsockname getaddrinfo getsockopt select freeaddrinfo send WSASend closesocket recv setsockopt WSACleanup connect

advapi32

GetTokenInformation OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges CopySid GetLengthSid SystemFunction036 IsValidSid LookupPrivilegeValueA

secur32

QueryContextAttributesW DeleteSecurityContext InitializeSecurityContextW FreeCredentialsHandle DecryptMessage AcceptSecurityContext FreeContextBuffer EncryptMessage AcquireCredentialsHandleA

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtQueryInformationProcess NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile RtlVirtualUnwind RtlGetVersion NtCreateNamedPipeFile

psapi

GetProcessMemoryInfo GetModuleFileNameExW

oleaut32

GetErrorInfo

powrprof

CallNtPowerInformation

pdh

PdhCloseQuery PdhRemoveCounter

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertGetCertificateChain CertDuplicateCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

user32

GetLastInputInfo

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen strcpy_s

api-ms-win-crt-heap-l1-1-0

_aligned_free malloc calloc _aligned_malloc free _callnewh _set_new_mode

api-ms-win-crt-utility-l1-1-0

_rotr64 _rotl64

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _crt_atexit _register_onexit_function terminate _register_thread_local_exe_atexit_callback _cexit __p___argv __p___argc abort _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

843KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

450KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_15eeefb6f8eda0ac042821560c2f603f_akira_cobalt-strike_coinminer_rusty-stealer_satacom

kernel32

shell32

ws2_32

advapi32

secur32

api-ms-win-core-synch-l1-2-0

ntdll

psapi

oleaut32

powrprof

pdh

crypt32

bcrypt

bcryptprimitives

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic