2026-08-03_5b7769c30d41eee9c1ac86609f57127a_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_5b7769c30d41eee9c1ac86609f57127a_akira_cobalt-strike_rusty-stealer_satacom
Size 361KB
Sample260803-c5qa4axanc
SHA256 70d78aff9aea4adb5cf7390862662bc485a9ba13aef61476f91d1de43ae7f559
MD5 5b7769c30d41eee9c1ac86609f57127a
SHA1 a0c5357908dadb7f520bbe9627a7538758cf71b1
SHA512 2cb8b17b1b5e1181946ca0136dfddc13e520427a268831b9b90d001e3b60d0841b5ccf1e55447d40e774978bf4170cfa2cec3fce9a8adcd48767c585c8b81fc9
SSDEEP 6144:+9l1Ds8ncwNvYK5SPgloSkg77gqnHgEOytBJ25BS21:+9bsicoEoAqVw5L1
TLSH
T139747B1BF64404F9D9E7C0B68317DBB3B53774CC0B6264FB06A842141E1AAE87B39769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_5b7769c30d41eee9c1ac86609f57127a_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-03_5b7769c30d41eee9c1ac86609f57127a_akira_cobalt-strike_rusty-stealer_satacom

.exe 361KB

2026-08-03_5b7769c30d41eee9c1ac86609f57127a_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH e2c4a4af43e03e8c9a4d92e28fdb8e82
SHA256 70d78aff9aea4adb5cf7390862662bc485a9ba13aef61476f91d1de43ae7f559
MD5 5b7769c30d41eee9c1ac86609f57127a
SHA1 a0c5357908dadb7f520bbe9627a7538758cf71b1
SHA512 2cb8b17b1b5e1181946ca0136dfddc13e520427a268831b9b90d001e3b60d0841b5ccf1e55447d40e774978bf4170cfa2cec3fce9a8adcd48767c585c8b81fc9
SSDEEP 6144:+9l1Ds8ncwNvYK5SPgloSkg77gqnHgEOytBJ25BS21:+9bsicoEoAqVw5L1
TLSH
T139747B1BF64404F9D9E7C0B68317DBB3B53774CC0B6264FB06A842141E1AAE87B39769
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

SetHandleInformation CloseHandle GetModuleHandleA SetLastError LoadLibraryA HeapAlloc GetSystemTimeAsFileTime GetProcAddress GetModuleHandleW HeapFree HeapReAlloc FreeLibrary GetProcessHeap GetModuleFileNameW GetLastError WideCharToMultiByte SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFinalPathNameByHandleW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId CreateThread GetFileSizeEx WriteFile CreateDirectoryW GetFileAttributesW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW DeleteFileW CreateFileW SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

bcrypt

BCryptGenRandom BCryptDecrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty

advapi32

SystemFunction036

secur32

QueryContextAttributesW FreeContextBuffer EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext DecryptMessage

crypt32

CertFreeCertificateContext CertAddCertificateContextToStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertDuplicateStore CertDuplicateCertificateChain CertOpenStore CertDuplicateCertificateContext CertCloseStore CertEnumCertificatesInStore

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

GetDesktopWindow

ws2_32

getsockopt setsockopt WSACleanup getsockname getpeername select connect ioctlsocket WSASocketW freeaddrinfo send getaddrinfo recv closesocket WSAStartup WSAGetLastError

vcruntime140

__current_exception_context __C_specific_handler __current_exception memset memmove memcmp memcpy __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit __p___argc _initialize_narrow_environment _configure_narrow_argv _exit _c_exit exit terminate _register_thread_local_exe_atexit_callback _crt_atexit _set_app_type _register_onexit_function _initterm_e _initterm _get_initial_narrow_environment _initialize_onexit_table _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_5b7769c30d41eee9c1ac86609f57127a_akira_cobalt-strike_rusty-stealer_satacom

kernel32

bcrypt

advapi32

secur32

crypt32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

user32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic