Extracted

• • Target
    2026-07-17_df0299116c2e45ceaa2ad58bddbdb970_akira_cobalt-strike_rusty-stealer_satacom
  • Size 213KB
  • SHA256 d1e968900cf95369b80dbc0e7e983e5563e459b45df66c2bb9fae03f9517d14a
  • MD5 df0299116c2e45ceaa2ad58bddbdb970
  • SHA1 b2c3af59e0aa5afe59caffa4a32d66b87aeca629
  • SHA512 535fa29841fb897b8dcee32193f6d2c77b7a6fd33727793cdb289bc171f57822fcf163052debdf9f693e041154054af22562744acf381e934070d139581a6ec1
  • SSDEEP 6144:wT19CvLCREEu00K1ZtniiK9LmGyqCR1/z:1jjKHuqR5
  • TLSH
    T171244A127E569CB8E947C0B48316C5B36A3678C60F22B9FF01E451393F29AE97F38654
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2