2026-07-16_3d89f854b64878df6d188ac8d7eaeca8_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_3d89f854b64878df6d188ac8d7eaeca8_akira_cobalt-strike_rusty-stealer_satacom
Size 2.9MB
Sample260716-n37cdact3p
SHA256 6872e2e630409fd8c176a50ba623a14e2c284ef6fb5fcbb087f6297df7997c28
MD5 3d89f854b64878df6d188ac8d7eaeca8
SHA1 b7a3bc9dd0f88d944cfe0f6033c27bf6222a025f
SHA512 24bce7018d24cfdbe037053afecb849dd43a521d3a200ca73bbf1a593232423ff8f7bcf210a853d0a4f52697e38adc629d6a84309c26cad1aae9d6f16d460994
SSDEEP 24576:EmldMxjdAvsS9WkZWWY1uaOUD7wQMg+qTr5yLdgAGOF9LTw0qnPIwBTX:wjusSp67wQMyTkLdgAn7HC
TLSH
T18BE5D515BA1F686CD55AC870830649330A2434DB1B36BDFF05C896793FADBF49B38A58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_3d89f854b64878df6d188ac8d7eaeca8_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-16_3d89f854b64878df6d188ac8d7eaeca8_akira_cobalt-strike_rusty-stealer_satacom

.exe 2.9MB

2026-07-16_3d89f854b64878df6d188ac8d7eaeca8_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 7e4d28315669b4994ab3626858200887
SHA256 6872e2e630409fd8c176a50ba623a14e2c284ef6fb5fcbb087f6297df7997c28
MD5 3d89f854b64878df6d188ac8d7eaeca8
SHA1 b7a3bc9dd0f88d944cfe0f6033c27bf6222a025f
SHA512 24bce7018d24cfdbe037053afecb849dd43a521d3a200ca73bbf1a593232423ff8f7bcf210a853d0a4f52697e38adc629d6a84309c26cad1aae9d6f16d460994
SSDEEP 24576:EmldMxjdAvsS9WkZWWY1uaOUD7wQMg+qTr5yLdgAGOF9LTw0qnPIwBTX:wjusSp67wQMyTkLdgAn7HC
TLSH
T18BE5D515BA1F686CD55AC870830649330A2434DB1B36BDFF05C896793FADBF49B38A58
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2319632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pyfun.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CloseHandle CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex HeapAlloc GetModuleFileNameW ReadConsoleW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetModuleHandleW FormatMessageW GetModuleHandleA GetTempPathW FindNextFileW

ntdll

NtWriteFile NtOpenFile NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError

vcruntime140

__CxxFrameHandler3 memset __current_exception __C_specific_handler memcmp __current_exception_context memcpy _CxxThrowException memmove

api-ms-win-crt-math-l1-1-0

__setusermatherr trunc

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _seh_filter_exe terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _crt_atexit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _c_exit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_3d89f854b64878df6d188ac8d7eaeca8_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic