2026-07-23_fa148ca8681307202d25a6a94454000d_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_fa148ca8681307202d25a6a94454000d_akira_cobalt-strike_rusty-stealer_satacom
Size 1.4MB
Sample260723-d79ceszhmg
SHA256 a45343b55c642084dbac5255254e1fdc6294a622b17ce838e949d880d0de50f2
MD5 fa148ca8681307202d25a6a94454000d
SHA1 f8b9a1ad39207a8031e1e55725072d19b19557d7
SHA512 6f458096a3d32fd6dd8f5a49cd4ed593a4f7f6ccc41d3173a3bc2c5424aad9748d2baac01ed359a352af64e2e792fd7ab626858731b302bec94f90dade4a9ac3
SSDEEP 24576:bpiZR36endA657smx51Pw7DFM8VIH06iyKY:bpe676573x51q1IU6iJ
TLSH
T1B4657C53E2A181ECC46EC4B58347A632FA31BC89472479EF1BD487212E56FD06B3C75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_fa148ca8681307202d25a6a94454000d_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-23_fa148ca8681307202d25a6a94454000d_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.4MB

2026-07-23_fa148ca8681307202d25a6a94454000d_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 8ea4d97fbaed78778f9375aae54b614c
SHA256 a45343b55c642084dbac5255254e1fdc6294a622b17ce838e949d880d0de50f2
MD5 fa148ca8681307202d25a6a94454000d
SHA1 f8b9a1ad39207a8031e1e55725072d19b19557d7
SHA512 6f458096a3d32fd6dd8f5a49cd4ed593a4f7f6ccc41d3173a3bc2c5424aad9748d2baac01ed359a352af64e2e792fd7ab626858731b302bec94f90dade4a9ac3
SSDEEP 24576:bpiZR36endA657smx51Pw7DFM8VIH06iyKY:bpe676573x51q1IU6iJ
TLSH
T1B4657C53E2A181ECC46EC4B58347A632FA31BC89472479EF1BD487212E56FD06B3C75A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

996288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app_host.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

kernel32

GetSystemTimeAsFileTime GetTempPathW InitializeSListHead SetUnhandledExceptionFilter WriteConsoleW CreateFileW CloseHandle DeleteFileW MoveFileExW GetFileAttributesW CreateDirectoryW RemoveDirectoryW GetFileSizeEx ReadFile WriteFile FindFirstFileW FindNextFileW FindClose GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary RtlVirtualUnwind GetLastError WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetModuleHandleW FormatMessageW

ntdll

NtWriteFile RtlNtStatusToDosError

ws2_32

setsockopt getsockopt ioctlsocket recv send WSARecv getaddrinfo connect select WSASocketW WSAStartup WSACleanup freeaddrinfo WSAGetLastError closesocket WSASend

bcrypt

BCryptGenRandom

vcruntime140

memmove memcmp __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memset memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _register_onexit_function _register_thread_local_exe_atexit_callback _initialize_narrow_environment _c_exit _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_fa148ca8681307202d25a6a94454000d_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ntdll

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic