2026-07-31_0a947c5168835aa73e90e81a876ae909_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_0a947c5168835aa73e90e81a876ae909_akira_cobalt-strike_rusty-stealer_satacom
Size 4.4MB
Sample260731-d4phvaam81
SHA256 15d0dc227f6c432e330827fe4a8f59f1f935e1aa366a1e40edeef57a0d06cbaf
MD5 0a947c5168835aa73e90e81a876ae909
SHA1 ebeb9f244fd1652e2ff092981152ef2ff48f4cc5
SHA512 ce90351ed932dc1205f68e776e20fa746fc90a0b1a8969b5fb5b36e76ad2ba6dc3b9965c599fe17c6dfa3df6a9fbe97e7e9510929545d71787b90e6644550250
SSDEEP 49152:0fZMGrlcUUqZoICqmoMWB+gJ5W8XZFHJownz7jt9bbKJelrm0hriPZ:0hMG/Zovfo7B+olvtnPbkx
TLSH
T130268D03E362D2ECC11AD4745615B233AB62BC491B3476EF6FC47A207EA7FD05A28719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_0a947c5168835aa73e90e81a876ae909_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-07-31_0a947c5168835aa73e90e81a876ae909_akira_cobalt-strike_rusty-stealer_satacom

.exe 4.4MB

2026-07-31_0a947c5168835aa73e90e81a876ae909_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH cf78baa542eb48b7395228a5a3e6ce7b
SHA256 15d0dc227f6c432e330827fe4a8f59f1f935e1aa366a1e40edeef57a0d06cbaf
MD5 0a947c5168835aa73e90e81a876ae909
SHA1 ebeb9f244fd1652e2ff092981152ef2ff48f4cc5
SHA512 ce90351ed932dc1205f68e776e20fa746fc90a0b1a8969b5fb5b36e76ad2ba6dc3b9965c599fe17c6dfa3df6a9fbe97e7e9510929545d71787b90e6644550250
SSDEEP 49152:0fZMGrlcUUqZoICqmoMWB+gJ5W8XZFHJownz7jt9bbKJelrm0hriPZ:0hMG/Zovfo7B+olvtnPbkx
TLSH
T130268D03E362D2ECC11AD4745615B233AB62BC491B3476EF6FC47A207EA7FD05A28719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2205440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

kernel32

LoadLibraryA HeapReAlloc GlobalFree GetFileAttributesW GetModuleFileNameW CloseHandle LoadLibraryW FormatMessageW HeapAlloc LoadLibraryExW SetThreadErrorMode FreeLibrary GetLastError GetProcAddress GetCurrentProcessId HeapFree GetProcessHeap GetSystemTimeAsFileTime DuplicateHandle GetModuleHandleA GetComputerNameW PostQueuedCompletionStatus GlobalMemoryStatusEx GetSystemTimePreciseAsFileTime SetHandleInformation CreateIoCompletionPort CreateProcessW GetCurrentThread GlobalUnlock SetWaitableTimer SwitchToThread GlobalLock GlobalSize GetWindowsDirectoryW CreateWaitableTimerExW GlobalAlloc DeleteFileW GetSystemDirectoryW ExitProcess GetQueuedCompletionStatusEx Sleep GetFileInformationByHandleEx GetStdHandle GetConsoleMode GetConsoleOutputCP GetFileInformationByHandle WaitForSingleObject WriteConsoleW WriteFileEx SleepEx ReadFileEx SetLastError GetCurrentThreadId GetModuleHandleW CreateThread GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetCurrentProcess InitializeSListHead SetUnhandledExceptionFilter GetCurrentDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar QueryPerformanceFrequency QueryPerformanceCounter

user32

GetForegroundWindow SetWindowPlacement GetWindowPlacement EnableMenuItem ChangeDisplaySettingsExW FlashWindowEx SetWindowDisplayAffinity SetWindowTextW SetCursorPos GetWindowTextW GetWindowTextLengthW MonitorFromWindow GetWindowRect SetWindowLongW DestroyCursor DestroyIcon GetCursorPos ReleaseCapture MapVirtualKeyW GetKeyboardLayout GetMenu ScreenToClient MonitorFromRect SetCapture TrackMouseEvent GetKeyboardState CreateIcon IsIconic CreateIconFromResourceEx SendMessageW GetActiveWindow GetClientRect SystemParametersInfoA SendInput IsWindowVisible MonitorFromPoint GetMonitorInfoW EnumDisplayMonitors RemovePropW PostMessageW RegisterWindowMessageA RedrawWindow DestroyWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowLongPtrW InvalidateRgn SetWindowPos RegisterRawInputDevices CreateWindowExW RegisterClassExW SetForegroundWindow DefWindowProcW GetSystemMenu GetAsyncKeyState GetKeyState LoadCursorW ClientToScreen IsProcessDPIAware GetClipCursor ClipCursor ShowCursor SetCursor ShowWindow GetWindowLongW GetClassNameW CallWindowProcW SetWindowLongPtrW SetPropW GetPropW AdjustWindowRectEx ToUnicodeEx MsgWaitForMultipleObjectsEx GetClassInfoExW ReleaseDC GetSystemMetrics ValidateRect GetRawInputData GetDC MapVirtualKeyExW CloseTouchInputHandle OpenClipboard RegisterClipboardFormatW IsClipboardFormatAvailable GetClipboardData CloseClipboard EmptyClipboard SetClipboardData RegisterTouchWindow GetTouchInputInfo

gdi32

CreateCompatibleBitmap DeleteDC GetDIBits SelectObject CreateCompatibleDC CreateRectRgn GetDeviceCaps BitBlt DeleteObject ChoosePixelFormat SwapBuffers SetPixelFormat DescribePixelFormat

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaLookupId

oleaut32

VariantClear SetErrorInfo SysStringLen SafeArrayCreateVector SafeArrayPutElement GetErrorInfo SysAllocStringLen

ole32

CoCreateInstance RevokeDragDrop CoUninitialize CoInitializeEx RegisterDragDrop CoCreateFreeThreadedMarshaler OleInitialize

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtDeviceIoControlFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

ws2_32

recv connect getaddrinfo closesocket WSAGetLastError WSAStartup WSACleanup WSASocketW send freeaddrinfo

secur32

AcquireCredentialsHandleA QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext EncryptMessage DecryptMessage DeleteSecurityContext FreeCredentialsHandle

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertFreeCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertDuplicateStore CertCloseStore

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

RevertToSelf ImpersonateAnonymousToken GetUserNameW RegGetValueW

shlwapi

AssocQueryStringW

shell32

DragFinish DragQueryFileW

opengl32

wglShareLists wglGetCurrentDC wglCreateContext wglGetProcAddress wglGetCurrentContext wglMakeCurrent wglDeleteContext

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

vcruntime140

memcmp __current_exception_context __current_exception __C_specific_handler memset memcpy memmove

api-ms-win-crt-math-l1-1-0

expf _hypotf powf sin cos fmod roundf round acosf cbrtf cosf truncf exp2f floorf pow floor trunc atan2f ceilf __setusermatherr sinf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _configure_narrow_argv _initterm_e exit _exit strerror __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xta

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xha

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xea

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xda

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xva

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.txd

Size

512B

Virtual Size

326B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_0a947c5168835aa73e90e81a876ae909_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

user32

gdi32

uiautomationcore

oleaut32

ole32

ntdll

ws2_32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

advapi32

shlwapi

shell32

opengl32

imm32

dwmapi

uxtheme

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic