2026-07-22_d0ce021f1abb8a1809b39f0b98c30f0a_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_d0ce021f1abb8a1809b39f0b98c30f0a_akira_cobalt-strike_rusty-stealer_satacom
Size 926KB
Sample260722-28eq7sam51
SHA256 ec2150ace203f88bd99672d45ddcfec478aa92e8ae9367b3a09a71395381661f
MD5 d0ce021f1abb8a1809b39f0b98c30f0a
SHA1 ae27eab4a52413f7d04245b0e3419e3c33b582a3
SHA512 9c754d62d958f8f492018c8f1cb2378394d8e98f477eebe7c37c105919a483a0ed3281b0176d5e3caafdd7fb28b7a927f345937b95affdca3c43002f7729c51e
SSDEEP 12288:K2FN6naXglYLD4/pqiDFMhSeIttY3reTjD06MlNy89mCcc:K2yaXaYLDBiDFM3VIH06iy8Xl
TLSH
T19915AE27F26151E8C86EC0B5C3575632B632748D4B60A8FF1BD4C2612D2AFE16B3CB59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_d0ce021f1abb8a1809b39f0b98c30f0a_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-22_d0ce021f1abb8a1809b39f0b98c30f0a_akira_cobalt-strike_rusty-stealer_satacom

.exe 926KB

2026-07-22_d0ce021f1abb8a1809b39f0b98c30f0a_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH ab9bedf056ca1c982930423ceb23d7e1
SHA256 ec2150ace203f88bd99672d45ddcfec478aa92e8ae9367b3a09a71395381661f
MD5 d0ce021f1abb8a1809b39f0b98c30f0a
SHA1 ae27eab4a52413f7d04245b0e3419e3c33b582a3
SHA512 9c754d62d958f8f492018c8f1cb2378394d8e98f477eebe7c37c105919a483a0ed3281b0176d5e3caafdd7fb28b7a927f345937b95affdca3c43002f7729c51e
SSDEEP 12288:K2FN6naXglYLD4/pqiDFMhSeIttY3reTjD06MlNy89mCcc:K2yaXaYLDBiDFM3VIH06iy8Xl
TLSH
T19915AE27F26151E8C86EC0B5C3575632B632748D4B60A8FF1BD4C2612D2AFE16B3CB59
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

536752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app_host.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

kernel32

GetSystemTimeAsFileTime GetTempPathW InitializeSListHead SetUnhandledExceptionFilter GetConsoleMode CreateFileW CloseHandle DeleteFileW MoveFileExW GetFileAttributesW CreateDirectoryW RemoveDirectoryW GetFileSizeEx ReadFile WriteFile FindFirstFileW FindNextFileW FindClose GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary RtlVirtualUnwind GetLastError WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetModuleHandleW FormatMessageW

ntdll

NtWriteFile RtlNtStatusToDosError

ws2_32

setsockopt getsockopt ioctlsocket recv send getaddrinfo connect select WSASocketW WSAStartup WSACleanup freeaddrinfo WSAGetLastError closesocket

bcrypt

BCryptGenRandom

vcruntime140

memmove __CxxFrameHandler3 __current_exception_context __current_exception __C_specific_handler memset memcmp memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type terminate _crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _register_onexit_function _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _cexit _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_d0ce021f1abb8a1809b39f0b98c30f0a_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ntdll

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic