2026-07-31_1048b2fed92b17a8d3d2f2f8af54ebe2_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_1048b2fed92b17a8d3d2f2f8af54ebe2_akira_cobalt-strike_rusty-stealer_satacom
Size 362KB
Sample260731-d26pcaca84
SHA256 85404565778a10eab5270e44b2807783cd616206f7aa1b5fb38f8540cad56c62
MD5 1048b2fed92b17a8d3d2f2f8af54ebe2
SHA1 5c723ebdc37ffcc267d9c930fb347bd883a191b8
SHA512 63b4db2dd46bc1ae55c6cdbe699d267d4a1138aa2431fe95054fe8b3f78cedc520391cf08e16365b197d5ba968a50654b880125249a28026f338f81be23a8d85
SSDEEP 6144:77cOinzpUmZjaphf0+ZBs7n3KBssMQ0xxz5rNS0KVMQP:7nizpVmp1DSKqg
TLSH
T15D746C2BF68500F8D9D7C0BA8217C773B63770CC0F62A4FB1AE851141E59AA87B39719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_1048b2fed92b17a8d3d2f2f8af54ebe2_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-31_1048b2fed92b17a8d3d2f2f8af54ebe2_akira_cobalt-strike_rusty-stealer_satacom

.exe 362KB

2026-07-31_1048b2fed92b17a8d3d2f2f8af54ebe2_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 14b22f8c5c3e7b438c284bbd2c1bdeb3
SHA256 85404565778a10eab5270e44b2807783cd616206f7aa1b5fb38f8540cad56c62
MD5 1048b2fed92b17a8d3d2f2f8af54ebe2
SHA1 5c723ebdc37ffcc267d9c930fb347bd883a191b8
SHA512 63b4db2dd46bc1ae55c6cdbe699d267d4a1138aa2431fe95054fe8b3f78cedc520391cf08e16365b197d5ba968a50654b880125249a28026f338f81be23a8d85
SSDEEP 6144:77cOinzpUmZjaphf0+ZBs7n3KBssMQ0xxz5rNS0KVMQP:7nizpVmp1DSKqg
TLSH
T15D746C2BF68500F8D9D7C0BA8217C773B63770CC0F62A4FB1AE851141E59AA87B39719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

SetHandleInformation CloseHandle GetModuleHandleA SetLastError LoadLibraryA HeapAlloc GetSystemTimeAsFileTime GetProcAddress GetModuleHandleW HeapFree HeapReAlloc FreeLibrary GetProcessHeap GetModuleFileNameW GetLastError WideCharToMultiByte SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFinalPathNameByHandleW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId CreateThread GetFileSizeEx WriteFile CreateDirectoryW GetFileAttributesW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW DeleteFileW CreateFileW SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

bcrypt

BCryptGenRandom BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty

advapi32

SystemFunction036

secur32

QueryContextAttributesW FreeContextBuffer EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext DecryptMessage

crypt32

CertFreeCertificateContext CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertDuplicateStore CertDuplicateCertificateChain CertOpenStore CertDuplicateCertificateContext CertCloseStore CertEnumCertificatesInStore

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

SHGetFolderPathW

ws2_32

getsockopt setsockopt WSACleanup getsockname getpeername select connect ioctlsocket WSASocketW freeaddrinfo send getaddrinfo recv closesocket WSAStartup WSAGetLastError

vcruntime140

__current_exception_context __C_specific_handler __current_exception memset memmove memcmp memcpy __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit __p___argc _initialize_narrow_environment _configure_narrow_argv _exit _c_exit exit terminate _register_thread_local_exe_atexit_callback _crt_atexit _set_app_type _register_onexit_function _initterm_e _initterm _get_initial_narrow_environment _initialize_onexit_table _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_1048b2fed92b17a8d3d2f2f8af54ebe2_akira_cobalt-strike_rusty-stealer_satacom

kernel32

bcrypt

advapi32

secur32

crypt32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic