2026-07-29_3b5239767e5327f488ae19e72741196a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_3b5239767e5327f488ae19e72741196a_akira_cobalt-strike_coinminer_rusty-stealer_satacom
Size 1.3MB
Sample260729-m98ckseq6x
SHA256 1161cd2dccc2ebc6196e8657028934a68facc3937225525a8785cfacad3465e9
MD5 3b5239767e5327f488ae19e72741196a
SHA1 9ad5cce1a83034eab0bd50406dc084bc24638b45
SHA512 26f466bed41140c6fab7122e30fd18c83095a2007d4a80fe030a74a2cf5fec39b1976621761787e5e67a72c32a42f875439b263f1754696146d6febde4e9dae2
SSDEEP 24576:rJsWPngv+mcP6SD45Klu6uy+6FM3VIH06iyi:+enoBcP6SOKlu5FkYIU6i
TLSH
T1D0557C47E66581F8C5AEC07CC757A536FA2278894B34A2DB27D04B093E26FD0AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_3b5239767e5327f488ae19e72741196a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

File Explorer

2026-07-29_3b5239767e5327f488ae19e72741196a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

.exe 1.3MB

2026-07-29_3b5239767e5327f488ae19e72741196a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

IMPHASH 88aa0879f38b11fa6f3a1752dac403d1
SHA256 1161cd2dccc2ebc6196e8657028934a68facc3937225525a8785cfacad3465e9
MD5 3b5239767e5327f488ae19e72741196a
SHA1 9ad5cce1a83034eab0bd50406dc084bc24638b45
SHA512 26f466bed41140c6fab7122e30fd18c83095a2007d4a80fe030a74a2cf5fec39b1976621761787e5e67a72c32a42f875439b263f1754696146d6febde4e9dae2
SSDEEP 24576:rJsWPngv+mcP6SD45Klu6uy+6FM3VIH06iyi:+enoBcP6SOKlu5FkYIU6i
TLSH
T1D0557C47E66581F8C5AEC07CC757A536FA2278894B34A2DB27D04B093E26FD0AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

833408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

xmrminer.pdb

kernel32

GetLastError CreateDirectoryW GetSystemInfo GetLogicalProcessorInformation GetCurrentProcess SetProcessInformation GetTickCount GetModuleHandleW GetProcAddress GetSystemTimes SwitchToThread WaitForSingleObject AddVectoredExceptionHandler Sleep GetModuleHandleA GetCurrentThreadId GetConsoleMode GetConsoleOutputCP GetStdHandle MultiByteToWideChar WriteConsoleW FlsAlloc FlsFree FlsSetValue GetProcessHeap HeapReAlloc HeapFree HeapAlloc IsThreadAFiber SetLastError GetEnvironmentVariableW CreateThread GetCurrentThread SetThreadStackGuarantee ReadFileEx SleepEx WriteFileEx CompareStringOrdinal FormatMessageW CreateFileW SetFileTime SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW CreateMutexW QueryPerformanceFrequency QueryPerformanceCounter SetHandleInformation GetSystemTimePreciseAsFileTime DuplicateHandle ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile GetFileAttributesW GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW WaitForMultipleObjects GetExitCodeProcess CreateProcessW CopyFileExW CreateWaitableTimerExW SetWaitableTimer GetProcessTimes CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters OpenProcess ReadProcessMemory LocalFree VirtualQueryEx InitializeCriticalSectionEx EncodePointer FlsGetValue RtlUnwindEx RaiseException RtlPcToFileHeader SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId FindClose CloseHandle DeleteCriticalSection GetLargePageMinimum VirtualFree VirtualProtect VirtualAlloc

shell32

SHQueryUserNotificationState CommandLineToArgvW

ws2_32

WSAGetLastError WSASocketW WSAStartup ioctlsocket WSARecv getpeername getsockname getaddrinfo getsockopt select freeaddrinfo send WSASend closesocket recv setsockopt WSACleanup connect

advapi32

GetTokenInformation OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges CopySid GetLengthSid SystemFunction036 IsValidSid LookupPrivilegeValueA

secur32

QueryContextAttributesW DeleteSecurityContext InitializeSecurityContextW FreeCredentialsHandle DecryptMessage AcceptSecurityContext FreeContextBuffer EncryptMessage AcquireCredentialsHandleA

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtQueryInformationProcess NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile RtlVirtualUnwind RtlGetVersion NtCreateNamedPipeFile

psapi

GetProcessMemoryInfo GetModuleFileNameExW

oleaut32

GetErrorInfo

powrprof

CallNtPowerInformation

pdh

PdhCloseQuery PdhRemoveCounter

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertGetCertificateChain CertDuplicateCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

user32

GetLastInputInfo

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen strcpy_s

api-ms-win-crt-heap-l1-1-0

_aligned_free malloc calloc _aligned_malloc free _callnewh _set_new_mode

api-ms-win-crt-utility-l1-1-0

_rotr64 _rotl64

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _crt_atexit _register_onexit_function terminate _register_thread_local_exe_atexit_callback _cexit __p___argv __p___argc abort _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

843KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

450KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_3b5239767e5327f488ae19e72741196a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

kernel32

shell32

ws2_32

advapi32

secur32

api-ms-win-core-synch-l1-2-0

ntdll

psapi

oleaut32

powrprof

pdh

crypt32

bcrypt

bcryptprimitives

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic