2026-07-22_1dc87e6a547abd64483995096a0f558d_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_1dc87e6a547abd64483995096a0f558d_akira_cobalt-strike_rusty-stealer_satacom
Size 1.7MB
Sample260722-2da5jach89
SHA256 662d98d708e6f43da90ee00c974d3268ba658890a24a24561e8b8e59ced98313
MD5 1dc87e6a547abd64483995096a0f558d
SHA1 0b634145ce25215e1dcda80773aa505bc0b88e5b
SHA512 d39c15f4ebbeba064fab37c4e4d330c019d540a55ab61d47c4447b0cf52ae79d25cce59aa367b72ac32bcdf5f2e58db584a823d4411c6e84452f184fb3a30a06
SSDEEP 24576:2ZFXwUHtj9CS43KiobsQCX2obgdFMyVIH06iydY:09N5a3obZHnIU6i
TLSH
T1E2857D17E98250ADC07AC2B5D3475233B634B8C9532069FF13E482212DDABE4A77F75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_1dc87e6a547abd64483995096a0f558d_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-22_1dc87e6a547abd64483995096a0f558d_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.7MB

2026-07-22_1dc87e6a547abd64483995096a0f558d_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 03532ecfa7a1f6076283bf14c8894e8a
SHA256 662d98d708e6f43da90ee00c974d3268ba658890a24a24561e8b8e59ced98313
MD5 1dc87e6a547abd64483995096a0f558d
SHA1 0b634145ce25215e1dcda80773aa505bc0b88e5b
SHA512 d39c15f4ebbeba064fab37c4e4d330c019d540a55ab61d47c4447b0cf52ae79d25cce59aa367b72ac32bcdf5f2e58db584a823d4411c6e84452f184fb3a30a06
SSDEEP 24576:2ZFXwUHtj9CS43KiobsQCX2obgdFMyVIH06iydY:09N5a3obZHnIU6i
TLSH
T1E2857D17E98250ADC07AC2B5D3475233B634B8C9532069FF13E482212DDABE4A77F75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1049552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

InitializeSListHead SetUnhandledExceptionFilter SetWaitableTimer GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentVariableW GetModuleHandleW FreeLibrary GetProcAddress GetModuleHandleA LoadLibraryA CloseHandle RtlVirtualUnwind GetLastError WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation FlushFileBuffers GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW Sleep FormatMessageW GetTempPathW

advapi32

SystemFunction036

ntdll

NtWriteFile NtOpenFile RtlNtStatusToDosError

ws2_32

WSAGetLastError setsockopt getsockopt ioctlsocket recv send closesocket WSASend connect select WSASocketW WSAStartup WSACleanup freeaddrinfo getaddrinfo WSARecv

bcrypt

BCryptGenRandom

vcruntime140

memcmp memset __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memmove memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv terminate _initterm _initterm_e exit _exit _initialize_onexit_table __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_1dc87e6a547abd64483995096a0f558d_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ntdll

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic