2026-07-21_7c14cf4fd626aa21794a73c80ffccf5e_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_7c14cf4fd626aa21794a73c80ffccf5e_akira_cobalt-strike_rusty-stealer_satacom
Size 6.0MB
Sample260721-em2braev2n
SHA256 c5add20f4fc4ee58e8b38c2ba3490d94b7fb6b6ff7db1ba29617a3e0524516d5
MD5 7c14cf4fd626aa21794a73c80ffccf5e
SHA1 80631783287c3ef1deee33c32c4f3badcc51a6e4
SHA512 f9a6a4437e889764d6d5ae9c712cef3cc56f0c7c3c6b75695d9c885459856c437b245415a19d22004a478af983dda0e9ff82c6faaf009d73be9abdf6b783fc31
SSDEEP 98304:/OCg4wiSYG2bC2j2JIIYkLaRaCj4yuMI36:/H2iSyZYZyuh3
TLSH
T171565B2177AA58ADC06BC474830A46739A3134CB1B35BAFF44D496752F6AEF15F3C228
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_7c14cf4fd626aa21794a73c80ffccf5e_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-21_7c14cf4fd626aa21794a73c80ffccf5e_akira_cobalt-strike_rusty-stealer_satacom

.exe 6.0MB

2026-07-21_7c14cf4fd626aa21794a73c80ffccf5e_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH b18623dd17a1e2c380c242cd28735cbe
SHA256 c5add20f4fc4ee58e8b38c2ba3490d94b7fb6b6ff7db1ba29617a3e0524516d5
MD5 7c14cf4fd626aa21794a73c80ffccf5e
SHA1 80631783287c3ef1deee33c32c4f3badcc51a6e4
SHA512 f9a6a4437e889764d6d5ae9c712cef3cc56f0c7c3c6b75695d9c885459856c437b245415a19d22004a478af983dda0e9ff82c6faaf009d73be9abdf6b783fc31
SSDEEP 98304:/OCg4wiSYG2bC2j2JIIYkLaRaCj4yuMI36:/H2iSyZYZyuh3
TLSH
T171565B2177AA58ADC06BC474830A46739A3134CB1B35BAFF44D496752F6AEF15F3C228
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4110720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fensu.pdb

kernel32

GetConsoleMode GetFileInformationByHandle CloseHandle FindClose InitializeSListHead FindNextFileW GetModuleHandleA WaitForMultipleObjects GetFileType GetConsoleOutputCP WriteConsoleW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary GetModuleHandleW SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError SetFileInformationByHandle SetFileTime CreateThread CreateEventW ReadFileEx GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW SetUnhandledExceptionFilter SwitchToThread CreateMutexA ReleaseMutex GetFinalPathNameByHandleW GetModuleFileNameW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtReadFile

vcruntime140

memchr __C_specific_handler strrchr __current_exception memset memmove memcmp memcpy __current_exception_context __CxxFrameHandler3 strchr _CxxThrowException

api-ms-win-crt-string-l1-1-0

strcspn strspn strcmp strlen strncmp

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-heap-l1-1-0

free _msize malloc _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_cexit _initialize_onexit_table __p___argv _c_exit _register_thread_local_exe_atexit_callback terminate _register_onexit_function __p___argc _exit exit _initterm_e _beginthreadex _endthreadex _crt_atexit _initterm _get_initial_narrow_environment _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_7c14cf4fd626aa21794a73c80ffccf5e_akira_cobalt-strike_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic