2026-07-14_68bbbeac3eb98b50e7604a7638d21e1a_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_68bbbeac3eb98b50e7604a7638d21e1a_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom
Size 9.6MB
Sample260714-hlctjsf18m
SHA256 f920ec17db4db59013a1c108cd5de3df5363c2273386bce2103b5c4a7c9e6932
MD5 68bbbeac3eb98b50e7604a7638d21e1a
SHA1 64021bb7164b8b038fe2b74752a989e95fd078e8
SHA512 08e616809123e38e4abd7b5afecf41079b3bcdb3f3a2e8000ef64db0aa511f40099b9ef8ebed106ed343e8550a33731e5922d88a1774853ff3fd7a0a5069d3cf
SSDEEP 98304:MWYHE1OSf36Ugqy8L645T9C+67PHBKw4N0X5:+Hezgjr4N0
TLSH
T194A65B09B55BB8BCE25BC47083169A736E2134DB1A267DFB40C9C2383F7DBA05B29715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_68bbbeac3eb98b50e7604a7638d21e1a_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

File Explorer

2026-07-14_68bbbeac3eb98b50e7604a7638d21e1a_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

.exe 9.6MB

2026-07-14_68bbbeac3eb98b50e7604a7638d21e1a_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

IMPHASH 5040cc65e42519c2028cc521f0a7e72d
SHA256 f920ec17db4db59013a1c108cd5de3df5363c2273386bce2103b5c4a7c9e6932
MD5 68bbbeac3eb98b50e7604a7638d21e1a
SHA1 64021bb7164b8b038fe2b74752a989e95fd078e8
SHA512 08e616809123e38e4abd7b5afecf41079b3bcdb3f3a2e8000ef64db0aa511f40099b9ef8ebed106ed343e8550a33731e5922d88a1774853ff3fd7a0a5069d3cf
SSDEEP 98304:MWYHE1OSf36Ugqy8L645T9C+67PHBKw4N0X5:+Hezgjr4N0
TLSH
T194A65B09B55BB8BCE25BC47083169A736E2134DB1A267DFB40C9C2383F7DBA05B29715
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8222640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pounce.pdb

kernel32

GetLastError LoadLibraryExW SetThreadErrorMode SetFilePointerEx GetProcAddress GetModuleFileNameW FindNextFileW GetStdHandle GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo CloseHandle FindClose SetConsoleCursorPosition WriteConsoleW GetConsoleCursorInfo SetConsoleCursorInfo UnlockFile FillConsoleOutputCharacterA FillConsoleOutputAttribute ReadConsoleInputW GetNumberOfConsoleInputEvents GetTempPathW SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx DuplicateHandle CreateDirectoryW FindFirstFileExW ReadConsoleW GetConsoleOutputCP GetFileAttributesW GetFileType FreeLibrary ExitProcess SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CancelIo RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleA GetModuleHandleW MultiByteToWideChar HeapAlloc ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler GetCurrentProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOverlappedResult CreateEventW ReadFile QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReadFileEx WaitForSingleObject CompareStringOrdinal LockFileEx Sleep ResetEvent WaitForMultipleObjects GetSystemInfo GetCurrentProcessId SwitchToThread CreateThread SleepEx WriteFileEx GetSystemTimePreciseAsFileTime FormatMessageW GetProcessHeap HeapFree HeapReAlloc GlobalLock GlobalSize WideCharToMultiByte GlobalUnlock GetCurrentThread

advapi32

ImpersonateAnonymousToken RevertToSelf

ntdll

NtWriteFile NtOpenFile NtReadFile RtlNtStatusToDosError NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

user32

GetClipboardData CloseClipboard OpenClipboard

vcruntime140

memcpy __CxxFrameHandler3 memmove memset memcmp _CxxThrowException __C_specific_handler __current_exception_context __current_exception

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_app_type __p___argc __p___argv _cexit _c_exit terminate _register_thread_local_exe_atexit_callback _seh_filter_exe strerror _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

tan acos ceil cos log atan sinh asin log10 exp fma __setusermatherr floor atan2 trunc log1p tanh asinh cosh sin round acosh pow

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_68bbbeac3eb98b50e7604a7638d21e1a_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

kernel32

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic