2026-07-30_ce4f7154fd08d54cbfbe418c8b6ee786_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_ce4f7154fd08d54cbfbe418c8b6ee786_akira_cobalt-strike_rusty-stealer_satacom
Size 920KB
Sample260730-ddd97a1xes
SHA256 043eb66005165d7a9c0435fe5ea5065e0f10312246e5374ec33749e84c8bbbe9
MD5 ce4f7154fd08d54cbfbe418c8b6ee786
SHA1 44bebce406bd090abf4a17ae5db46f979e5162a2
SHA512 60d83c7948a057ae97554614e2bc44a68e4c857dbd4393e2228208905fa20646c2ae080133fd4975be2337fabb15a0df5ee33bbab5786b311b72c714f8de0bec
SSDEEP 24576:5SjJSgdPWhEp9ZLYrm7LE7Jx+IpgFvb2c70:8VdPMKA+IpgFvSc70
TLSH
T162151725BB5954E9C06BC438835A8A626A3034CF0B35B9FB04C985793F69BF55F3D328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_ce4f7154fd08d54cbfbe418c8b6ee786_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-30_ce4f7154fd08d54cbfbe418c8b6ee786_akira_cobalt-strike_rusty-stealer_satacom

.exe 920KB

2026-07-30_ce4f7154fd08d54cbfbe418c8b6ee786_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 77cc193766162c6e2078d39b259ea71b
SHA256 043eb66005165d7a9c0435fe5ea5065e0f10312246e5374ec33749e84c8bbbe9
MD5 ce4f7154fd08d54cbfbe418c8b6ee786
SHA1 44bebce406bd090abf4a17ae5db46f979e5162a2
SHA512 60d83c7948a057ae97554614e2bc44a68e4c857dbd4393e2228208905fa20646c2ae080133fd4975be2337fabb15a0df5ee33bbab5786b311b72c714f8de0bec
SSDEEP 24576:5SjJSgdPWhEp9ZLYrm7LE7Jx+IpgFvb2c70:8VdPMKA+IpgFvSc70
TLSH
T162151725BB5954E9C06BC438835A8A626A3034CF0B35B9FB04C985793F69BF55F3D328
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

678400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rust_out.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

GetSystemTimeAsFileTime SetUnhandledExceptionFilter InitializeSListHead CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileType GetModuleHandleW FormatMessageW WaitForMultipleObjects GetModuleHandleA

ntdll

NtWriteFile NtOpenFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcpy __current_exception __C_specific_handler __current_exception_context memset memmove memcmp _CxxThrowException

api-ms-win-crt-math-l1-1-0

__setusermatherr floor fmod

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_onexit_function __p___argc __p___argv _initialize_onexit_table _c_exit _register_thread_local_exe_atexit_callback terminate _configure_narrow_argv _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_ce4f7154fd08d54cbfbe418c8b6ee786_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic