2026-07-23_63962187e06a3b111a9ebb50ed97812b_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_63962187e06a3b111a9ebb50ed97812b_akira_cobalt-strike_rusty-stealer_satacom
Size 497KB
Sample260723-p6leraba63
SHA256 d90203772c6e40921eade7bde94fed0c40fc344e5de73b60981f13a98ff2c29f
MD5 63962187e06a3b111a9ebb50ed97812b
SHA1 2996abd710ca04bd9f2b167fce7824eadcf13c51
SHA512 82fce3e3eeb9fc4be69529aaa9a24d2a5e53cf8222a4a244f231431e16c2d08fda24db1a6a4af4b641eb1f3b7fa0af309c2bc73cac3dcbfe3eda3575a4df4f6b
SSDEEP 6144:umg+zh+K0662ZLzKkWD7MJcXkEo2h0me/fYGgG81mGMVa6J:umvhO662ZLG37MJPyZq
TLSH
T1CFB47C26F25153ECC86EC07883568632B63670C94B21B9FF07E846612E1AFF56F39758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_63962187e06a3b111a9ebb50ed97812b_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-23_63962187e06a3b111a9ebb50ed97812b_akira_cobalt-strike_rusty-stealer_satacom

.exe 497KB

2026-07-23_63962187e06a3b111a9ebb50ed97812b_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH b377880fee0a3d88a99f081f50545133
SHA256 d90203772c6e40921eade7bde94fed0c40fc344e5de73b60981f13a98ff2c29f
MD5 63962187e06a3b111a9ebb50ed97812b
SHA1 2996abd710ca04bd9f2b167fce7824eadcf13c51
SHA512 82fce3e3eeb9fc4be69529aaa9a24d2a5e53cf8222a4a244f231431e16c2d08fda24db1a6a4af4b641eb1f3b7fa0af309c2bc73cac3dcbfe3eda3575a4df4f6b
SSDEEP 6144:umg+zh+K0662ZLzKkWD7MJcXkEo2h0me/fYGgG81mGMVa6J:umvhO662ZLG37MJPyZq
TLSH
T1CFB47C26F25153ECC86EC07883568632B63670C94B21B9FF07E846612E1AFF56F39758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

335008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetThreadErrorMode FreeLibrary GetModuleHandleW GetProcAddress GetModuleFileNameW GetSystemTimeAsFileTime LoadLibraryExW GetLastError CloseHandle InitializeSListHead GetTempPathW GetModuleHandleA FormatMessageW Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar HeapAlloc SetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess SetUnhandledExceptionFilter lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler GetStdHandle RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentProcess GetCurrentThread CreateFileW DeleteFileW MoveFileExW GetFileAttributesW CreateDirectoryW RemoveDirectoryW GetFileSizeEx ReadFile WriteFile FindFirstFileW FindNextFileW FindClose WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId

secur32

AcceptSecurityContext AcquireCredentialsHandleA QueryContextAttributesW FreeCredentialsHandle InitializeSecurityContextW FreeContextBuffer DecryptMessage EncryptMessage DeleteSecurityContext

crypt32

CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertDuplicateStore CertCloseStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertFreeCertificateContext CertFreeCertificateChain

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

ntdll

NtWriteFile RtlNtStatusToDosError

ws2_32

WSAGetLastError getaddrinfo closesocket getsockname setsockopt WSAStartup ioctlsocket WSACleanup freeaddrinfo recv send getpeername connect select WSASocketW getsockopt

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3 __current_exception memset memcpy memmove __C_specific_handler memcmp __current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argc _c_exit _set_app_type _seh_filter_exe _exit _register_thread_local_exe_atexit_callback exit _initterm_e _cexit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm _get_initial_narrow_environment _initialize_narrow_environment __p___argv _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_63962187e06a3b111a9ebb50ed97812b_akira_cobalt-strike_rusty-stealer_satacom

kernel32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

ntdll

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic