2026-08-02_7fbd1afaf8da9800dcfd1fce139df75c_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_7fbd1afaf8da9800dcfd1fce139df75c_akira_cobalt-strike_rusty-stealer_satacom
Size 19.8MB
Sample260802-kbvbysfl7w
SHA256 d98b67a4482b5b9f9df7ee054616b8b0cb1ca651cd1b69cf04a5f81ef4b9235f
MD5 7fbd1afaf8da9800dcfd1fce139df75c
SHA1 603e184eaae8263cfef3227242ddcff6a916f7f9
SHA512 a9768e71c96e8d0d93f2468d1dfc07ee298fee3355351229897972296151d5d7f2bbb383ad332e1838d4f0b4f79181c14a49da79306500566e77b7d190c902e3
SSDEEP 98304:YBofQcap8phbvY8XjsFZqkkS9yXi/cXVTUHE6VVUayccPgTLFByNWlxs7tP9MXbE:6cZlnKpFrLLyKxg9CQUtZyuhB
TLSH
T1F42718113A9BA8ADD19AC870834A86735E2134DB1B36B9FF44C496393F69AF45F3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_7fbd1afaf8da9800dcfd1fce139df75c_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-02_7fbd1afaf8da9800dcfd1fce139df75c_akira_cobalt-strike_rusty-stealer_satacom

.exe 19.8MB

2026-08-02_7fbd1afaf8da9800dcfd1fce139df75c_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 462b920b3a8faf61b81cf295dda4e58a
SHA256 d98b67a4482b5b9f9df7ee054616b8b0cb1ca651cd1b69cf04a5f81ef4b9235f
MD5 7fbd1afaf8da9800dcfd1fce139df75c
SHA1 603e184eaae8263cfef3227242ddcff6a916f7f9
SHA512 a9768e71c96e8d0d93f2468d1dfc07ee298fee3355351229897972296151d5d7f2bbb383ad332e1838d4f0b4f79181c14a49da79306500566e77b7d190c902e3
SSDEEP 98304:YBofQcap8phbvY8XjsFZqkkS9yXi/cXVTUHE6VVUayccPgTLFByNWlxs7tP9MXbE:6cZlnKpFrLLyKxg9CQUtZyuhB
TLSH
T1F42718113A9BA8ADD19AC870834A86735E2134DB1B36B9FF44C496393F69AF45F3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14835184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

osr.pdb

kernel32

ReadFileEx SleepEx WriteFileEx GetCurrentThreadId QueryPerformanceFrequency QueryPerformanceCounter ReadFile CreateEventW GetOverlappedResult WaitForSingleObject GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW GetCurrentProcess WaitForMultipleObjects GetExitCodeProcess CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW WideCharToMultiByte GetConsoleOutputCP CreateMutexA ReleaseMutex CreateFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar GetModuleHandleW FormatMessageW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind MapViewOfFile CreateFileMappingW CancelIo SystemTimeToFileTime LockFileEx CompareStringOrdinal HeapCompact LoadLibraryW CreateFileA FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx OutputDebugStringA WriteFile HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection WaitForSingleObjectEx GetConsoleMode WriteConsoleW ReadConsoleW DeleteFileW GetFinalPathNameByHandleW FindFirstFileExW MoveFileExW SetFileAttributesW RemoveDirectoryW DuplicateHandle GetStdHandle GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx CreateSemaphoreW GetFileInformationByHandle SetFileTime GetFullPathNameW SetLastError SetUnhandledExceptionFilter CreateThread SwitchToThread HeapReAlloc GetCurrentProcessId HeapFree GetProcessHeap ReleaseSemaphore GetFileAttributesW HeapDestroy GetSystemInfo FlushFileBuffers GetTempPathW FindNextFileW GetTickCount ReadDirectoryChangesW SetFileInformationByHandle GetProcAddress GetModuleHandleA Sleep GetSystemTime InitializeSListHead AreFileApisANSI GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile GetTempPathA GetDiskFreeSpaceA FindClose CloseHandle GetFileAttributesA GetFileAttributesExW DeleteFileA UnlockFile LocalFree GetFileSize FreeLibrary FormatMessageA GetSystemTimeAsFileTime LoadLibraryA GetLastError

ntdll

NtReadFile NtWriteFile NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

vcruntime140

__C_specific_handler memmove memcmp memset _CxxThrowException strchr strrchr memchr __current_exception memcpy __current_exception_context __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strcmp strlen strspn strncmp strcspn

api-ms-win-crt-math-l1-1-0

sqrt __setusermatherr log fmod

api-ms-win-crt-heap-l1-1-0

realloc _msize malloc _set_new_mode free

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _register_onexit_function _initialize_onexit_table _beginthreadex _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _endthreadex _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_7fbd1afaf8da9800dcfd1fce139df75c_akira_cobalt-strike_rusty-stealer_satacom

kernel32

ntdll

bcryptprimitives

api-ms-win-core-synch-l1-2-0

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic