2026-07-28_3cb6cf4bb52de36425c05b01bdb31e2e_akira_cobalt-strike_poet-rat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_3cb6cf4bb52de36425c05b01bdb31e2e_akira_cobalt-strike_poet-rat_satacom
Size 22.1MB
Sample260729-btrjca1gkc
SHA256 fa778c8f55bfe5d4d32348ecf8f3f1120bf4ed70a2e6001ca5aa17341cfd85bb
MD5 3cb6cf4bb52de36425c05b01bdb31e2e
SHA1 602955b4787eba485387c5c8534725b9f892a0ab
SHA512 6309e57c74edba2223252683b43247e39ac872ab4e703bd63a5ec40c7181c0b8abb9df6c4df41f853d2db97eef2e3827d1a3dcebd7ad7164d3ba4bd20debbc81
SSDEEP 393216:FESErTlMC8nTiG1ekhoCDzxkQyEmuvggYtaxGAA:N6JOGj
TLSH
T13F373811BA8A696CD55AC4B083464A732A3134DB1B35BAFF45C482782F6DBF42F3C719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_3cb6cf4bb52de36425c05b01bdb31e2e_akira_cobalt-strike_poet-rat_satacom

File Explorer

2026-07-28_3cb6cf4bb52de36425c05b01bdb31e2e_akira_cobalt-strike_poet-rat_satacom

.exe 22.1MB

2026-07-28_3cb6cf4bb52de36425c05b01bdb31e2e_akira_cobalt-strike_poet-rat_satacom

IMPHASH d50d619e727ee3e3cdf3c8b367f316aa
SHA256 fa778c8f55bfe5d4d32348ecf8f3f1120bf4ed70a2e6001ca5aa17341cfd85bb
MD5 3cb6cf4bb52de36425c05b01bdb31e2e
SHA1 602955b4787eba485387c5c8534725b9f892a0ab
SHA512 6309e57c74edba2223252683b43247e39ac872ab4e703bd63a5ec40c7181c0b8abb9df6c4df41f853d2db97eef2e3827d1a3dcebd7ad7164d3ba4bd20debbc81
SSDEEP 393216:FESErTlMC8nTiG1ekhoCDzxkQyEmuvggYtaxGAA:N6JOGj
TLSH
T13F373811BA8A696CD55AC4B083464A732A3134DB1B35BAFF45C482782F6DBF42F3C719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16641232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

krokiet.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

GetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo SystemTimeToFileTime GlobalLock GlobalSize GlobalUnlock WideCharToMultiByte SystemTimeToTzSpecificLocalTime GlobalAlloc GlobalFree MultiByteToWideChar GetUserDefaultLocaleName Sleep GetSystemInfo GetModuleHandleA FormatMessageW WaitForSingleObject HeapAlloc GetLastError FreeLibrary GetProcAddress LoadLibraryA HeapFree GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead SetThreadErrorMode IsDebuggerPresent CloseHandle CreateMutexA WaitForSingleObjectEx GetFullPathNameW GetCurrentThread CreateThread WriteConsoleW UpdateProcThreadAttribute InitializeProcThreadAttributeList GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW ReadFileEx CreateNamedPipeW GetModuleHandleW LoadLibraryW SetConsoleMode LoadLibraryExW lstrlenW GetProcessHeap CopyFileExW GetCurrentThreadId UnmapViewOfFile CreateFileMappingW MapViewOfFile GetCurrentProcess DuplicateHandle VirtualProtect GetFinalPathNameByHandleW FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread CreateWaitableTimerExW SetWaitableTimer QueryPerformanceCounter RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW CreateHardLinkW SetFileInformationByHandle SetFilePointerEx DeviceIoControl MoveFileExW DeleteFileW FindFirstFileW CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CreateFileW FindClose FindNextFileW ReleaseMutex GetStdHandle GetCurrentProcessId HeapReAlloc GetSystemTimePreciseAsFileTime WriteFileEx SleepEx GetExitCodeProcess TerminateProcess QueryPerformanceFrequency

shell32

DragQueryFileW SHGetKnownFolderPath SHCreateItemFromParsingName DragFinish

ole32

OleInitialize CoInitializeEx RegisterDragDrop RevokeDragDrop CoCreateInstance CoUninitialize CoTaskMemFree

user32

GetAsyncKeyState SetForegroundWindow SendInput SetWindowTextW GetRawInputData RegisterRawInputDevices GetKeyState GetMenu LoadCursorW SetCursor GetKeyboardState MapVirtualKeyExW GetWindowRect MonitorFromRect ShowCursor ValidateRect GetClipCursor DefWindowProcW GetTouchInputInfo GetActiveWindow ScreenToClient CloseTouchInputHandle SetWindowLongPtrW ClientToScreen AdjustWindowRectEx GetWindowLongW SetWindowLongW SendMessageW EnableMenuItem GetSystemMenu ShowWindow MapVirtualKeyW DestroyIcon CreateIcon ReleaseCapture SetCapture RegisterWindowMessageA KillTimer SetTimer GetMessageW CloseClipboard SetClipboardData EmptyClipboard SystemParametersInfoA GetClipboardData OpenClipboard GetWindowLongPtrW GetKeyboardLayout ToUnicodeEx GetClassInfoExW GetClassNameW IsProcessDPIAware DestroyWindow PostMessageW GetDC GetSystemMetrics SetWindowDisplayAffinity ClipCursor RegisterTouchWindow GetClientRect InvalidateRgn SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW CreateWindowExW RegisterClassExW DispatchMessageW TranslateMessage PeekMessageW ReleaseDC RedrawWindow SetWindowPos GetMonitorInfoW MonitorFromWindow GetCursorPos TrackMouseEvent

oleaut32

SysFreeString GetErrorInfo SysStringLen

advapi32

RegOpenKeyExW RegQueryValueExW

gdi32

CreateRectRgn CreateCompatibleDC CreateDIBSection SelectObject BitBlt SetPixelFormat SwapBuffers DeleteObject DeleteDC DescribePixelFormat ChoosePixelFormat GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

opengl32

wglGetProcAddress wglShareLists wglGetCurrentContext wglDeleteContext wglMakeCurrent wglCreateContext

uxtheme

SetWindowTheme

imm32

ImmSetCompositionWindow ImmGetCompositionStringW ImmGetContext ImmSetCandidateWindow ImmAssociateContextEx ImmReleaseContext

ntdll

NtReadFile RtlNtStatusToDosError NtCreateFile NtWriteFile

vcruntime140

memmove __current_exception __C_specific_handler _CxxThrowException memset memcpy memcmp __CxxFrameHandler3 __current_exception_context

api-ms-win-crt-math-l1-1-0

trunc tan floorf _hypot log2 pow truncf ceilf log exp2 roundf floor atan exp2f sinf cosf powf cbrtf fmod ceil cos sin round acos tanf __setusermatherr atan2f acosf fmodf expf atan2

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _c_exit _configure_narrow_argv _initialize_onexit_table _set_app_type _seh_filter_exe _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_3cb6cf4bb52de36425c05b01bdb31e2e_akira_cobalt-strike_poet-rat_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

shell32

ole32

user32

oleaut32

advapi32

gdi32

dwmapi

opengl32

uxtheme

imm32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic