2026-07-20_28f826077a15fd4fa9e4d60b5c1f3705_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_28f826077a15fd4fa9e4d60b5c1f3705_akira_cobalt-strike_rusty-stealer_satacom
Size 1.7MB
Sample260720-yd5glae12t
SHA256 3daf31216fcc99c90284650cfc3db9a473ff2c1bfffc8ae453087296a133378d
MD5 28f826077a15fd4fa9e4d60b5c1f3705
SHA1 210c22b5e1a1b0d4314a0e080dc7e0223c65497d
SHA512 6fec29549f980838dfcd2b7bdbf1159abb5de0fac7282f36bee247fba84b87c3ffdbf70172d12b4ad7c10d3d4d48cf56b04b541cd16a9f5dce61411b561884d2
SSDEEP 24576:MUfqG+jlJtRlLeZTRYRlVKc8iURZcmSFMKVIH06iyXt:zLyXRlySVKYmsHIU6iS
TLSH
T10F857C17E58250ADC47AC2B5D3075232B634B8C9532069FF13E482212EDABE4E77F75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_28f826077a15fd4fa9e4d60b5c1f3705_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-20_28f826077a15fd4fa9e4d60b5c1f3705_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.7MB

2026-07-20_28f826077a15fd4fa9e4d60b5c1f3705_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH bc69ee8214dbc59ccce042e2125382fb
SHA256 3daf31216fcc99c90284650cfc3db9a473ff2c1bfffc8ae453087296a133378d
MD5 28f826077a15fd4fa9e4d60b5c1f3705
SHA1 210c22b5e1a1b0d4314a0e080dc7e0223c65497d
SHA512 6fec29549f980838dfcd2b7bdbf1159abb5de0fac7282f36bee247fba84b87c3ffdbf70172d12b4ad7c10d3d4d48cf56b04b541cd16a9f5dce61411b561884d2
SSDEEP 24576:MUfqG+jlJtRlLeZTRYRlVKc8iURZcmSFMKVIH06iyXt:zLyXRlySVKYmsHIU6iS
TLSH
T10F857C17E58250ADC47AC2B5D3075232B634B8C9532069FF13E482212EDABE4E77F75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1049104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

kernel32

GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter SetWaitableTimer FreeLibrary GetProcAddress GetModuleHandleA LoadLibraryA CloseHandle RtlVirtualUnwind GetLastError WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId FlushFileBuffers GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW Sleep GetModuleHandleW FormatMessageW GetTempPathW

ntdll

NtOpenFile NtWriteFile RtlNtStatusToDosError

ws2_32

setsockopt getsockopt ioctlsocket recv send WSARecv getaddrinfo connect select WSASocketW WSAStartup WSACleanup freeaddrinfo WSAGetLastError closesocket WSASend

bcrypt

BCryptGenRandom

vcruntime140

memcpy memmove __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memcmp memset

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _register_onexit_function _register_thread_local_exe_atexit_callback _initialize_narrow_environment _c_exit _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_28f826077a15fd4fa9e4d60b5c1f3705_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ntdll

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic