2026-07-30_3429cbf26a475402d16a37f875ac5363_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_3429cbf26a475402d16a37f875ac5363_akira_cobalt-strike_rusty-stealer_satacom
Size 3.3MB
Sample260730-ghs6pacf36
SHA256 d256fc488c305cb6ecd9b4b2db2cb83a8509b004f32689a66a1617d15114003b
MD5 3429cbf26a475402d16a37f875ac5363
SHA1 22f94e5a16f7e162b04fa11141a44288d4727099
SHA512 4f713b975e2572d62ea343dd1113cf3f418dbf4035c9e7830e435ac4540a7862793d62d9d99b2dfeafc3eb98f518f364d89cdb69febe7f36ac911ac65aa21246
SSDEEP 49152:FhrlpifA/BtHhzdon9SlxT50nxeyzUG2eEXm2Ury07GALq745xhqIEeo:FhRt/ZZiBAA27A/o
TLSH
T1DFF52B16B67954EAD17AC07883838F626E20308E0B397BF755D4827A2F25EF86D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_3429cbf26a475402d16a37f875ac5363_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-30_3429cbf26a475402d16a37f875ac5363_akira_cobalt-strike_rusty-stealer_satacom

.exe 3.3MB

2026-07-30_3429cbf26a475402d16a37f875ac5363_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 7866e68105b40647e202591d8fb21a8a
SHA256 d256fc488c305cb6ecd9b4b2db2cb83a8509b004f32689a66a1617d15114003b
MD5 3429cbf26a475402d16a37f875ac5363
SHA1 22f94e5a16f7e162b04fa11141a44288d4727099
SHA512 4f713b975e2572d62ea343dd1113cf3f418dbf4035c9e7830e435ac4540a7862793d62d9d99b2dfeafc3eb98f518f364d89cdb69febe7f36ac911ac65aa21246
SSDEEP 49152:FhrlpifA/BtHhzdon9SlxT50nxeyzUG2eEXm2Ury07GALq745xhqIEeo:FhRt/ZZiBAA27A/o
TLSH
T1DFF52B16B67954EAD17AC07883838F626E20308E0B397BF755D4827A2F25EF86D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2005456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

robustness-e5acc4fae01604f3.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileType GetModuleHandleW FormatMessageW WaitForMultipleObjects GetModuleHandleA

ntdll

NtWriteFile NtOpenFile NtReadFile RtlNtStatusToDosError NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context _CxxThrowException memcmp memmove memset __C_specific_handler __current_exception __CxxFrameHandler3 memcpy

api-ms-win-crt-math-l1-1-0

fmod floor log cos exp sin tan acos asin atan ceil pow trunc log10 round __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe terminate _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_3429cbf26a475402d16a37f875ac5363_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic