2026-07-22_ea880d79c1c1953982d316edc2c080b2_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_ea880d79c1c1953982d316edc2c080b2_akira_cobalt-strike_rusty-stealer_satacom
Size 1.5MB
Sample260722-vb2q5she97
SHA256 ac7197fe31764536ccd1a2d312c2c6ce878a9ee2e9fabb9356db7afbcb75a1c2
MD5 ea880d79c1c1953982d316edc2c080b2
SHA1 a6ca4eb9b8e4eb3970e7be65539e73965aa57e1b
SHA512 df25f58ec24dba5ea18b6c82444e740356ff72fc1738fd9376ae8923206a2d2fb838a5326a359ad2ff1722fc68abd9845d4bd333237ad2dd0bbd654313c8132b
SSDEEP 24576:AZg2TRFkvtBWuvuZJQKyE+FsFOxopF26WUAWuZ3TYA:k6XG3QThFsFOxopF26T23T
TLSH
T1E9751921BB5A99ACC19AC470834649735A3130DB1F36B8FF44D496793FA9AF41F38368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_ea880d79c1c1953982d316edc2c080b2_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-22_ea880d79c1c1953982d316edc2c080b2_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.5MB

2026-07-22_ea880d79c1c1953982d316edc2c080b2_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 7440226bd7b017ab1d237602631ef6c4
SHA256 ac7197fe31764536ccd1a2d312c2c6ce878a9ee2e9fabb9356db7afbcb75a1c2
MD5 ea880d79c1c1953982d316edc2c080b2
SHA1 a6ca4eb9b8e4eb3970e7be65539e73965aa57e1b
SHA512 df25f58ec24dba5ea18b6c82444e740356ff72fc1738fd9376ae8923206a2d2fb838a5326a359ad2ff1722fc68abd9845d4bd333237ad2dd0bbd654313c8132b
SSDEEP 24576:AZg2TRFkvtBWuvuZJQKyE+FsFOxopF26WUAWuZ3TYA:k6XG3QThFsFOxopF26T23T
TLSH
T1E9751921BB5A99ACC19AC470834649735A3130DB1F36B8FF44D496793FA9AF41F38368
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1136512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zap.pdb

kernel32

SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentThreadId CreateEventW GetFullPathNameW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime SetLastError SleepEx GetFileInformationByHandle WriteFileEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW lstrlenW WaitForSingleObject FindFirstFileExW FindClose ExitProcess SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW GetLastError DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP GetFileAttributesW GetFileType GetModuleHandleW FormatMessageW CompareStringOrdinal GetSystemTimeAsFileTime WaitForMultipleObjects GetModuleHandleA InitializeSListHead FindNextFileW MoveFileExW GetFileInformationByHandleEx SetUnhandledExceptionFilter GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode SetHandleInformation CancelIo CloseHandle

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSAStartup WSAGetLastError getaddrinfo freeaddrinfo WSACleanup WSADuplicateSocketW setsockopt shutdown listen bind WSASocketW send recv connect getsockname accept closesocket getpeername

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

vcruntime140

_CxxThrowException memcmp memmove memcpy __CxxFrameHandler3 __C_specific_handler __current_exception __current_exception_context memset

api-ms-win-crt-runtime-l1-1-0

terminate _initterm_e _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment exit _crt_atexit _register_thread_local_exe_atexit_callback _initterm _cexit __p___argv __p___argc _seh_filter_exe _set_app_type _initialize_narrow_environment _c_exit _exit _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_ea880d79c1c1953982d316edc2c080b2_akira_cobalt-strike_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic