2026-08-03_2678fd2748ac65b466738263b6a8ab24_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_2678fd2748ac65b466738263b6a8ab24_akira_cobalt-strike_rusty-stealer_satacom
Size 11.4MB
Sample260803-h396da1djb
SHA256 986db1abcf38016ce774b2349905a0685e0b0dc5b0209a775b52ae8ff4d99a02
MD5 2678fd2748ac65b466738263b6a8ab24
SHA1 85082efd72efeddba67a167ef611e473be2cc4fa
SHA512 60f7090792edf4f6c6ec995bb1b7410d78111dde6c841579c6b4461a9ebfb97f67d4663b88d1d9a631a61c63dd19f2f2eb2a321af9d104641d294567e375f734
SSDEEP 98304:iE4Htz9YV5DZu4GmqvvWyK96m/qSnpjqZifVzQwoa:i7tzGXlmVN6pjq3W
TLSH
T19DC6D61A6B5ED85AE16BC47483464B624AE130DB4B29B8FF44C552792FEFAF01B3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_2678fd2748ac65b466738263b6a8ab24_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-03_2678fd2748ac65b466738263b6a8ab24_akira_cobalt-strike_rusty-stealer_satacom

.exe 11.4MB

2026-08-03_2678fd2748ac65b466738263b6a8ab24_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 551a086d09ad4ae78f5ade4ea881e067
SHA256 986db1abcf38016ce774b2349905a0685e0b0dc5b0209a775b52ae8ff4d99a02
MD5 2678fd2748ac65b466738263b6a8ab24
SHA1 85082efd72efeddba67a167ef611e473be2cc4fa
SHA512 60f7090792edf4f6c6ec995bb1b7410d78111dde6c841579c6b4461a9ebfb97f67d4663b88d1d9a631a61c63dd19f2f2eb2a321af9d104641d294567e375f734
SSDEEP 98304:iE4Htz9YV5DZu4GmqvvWyK96m/qSnpjqZifVzQwoa:i7tzGXlmVN6pjq3W
TLSH
T19DC6D61A6B5ED85AE16BC47483464B624AE130DB4B29B8FF44C552792FEFAF01B3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9063552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

k_ruoka_mcp.pdb

kernel32

PostQueuedCompletionStatus CloseHandle GetCurrentProcess SetHandleInformation CreateFileW HeapAlloc FormatMessageW GetModuleHandleA UnregisterWaitEx HeapFree GetProcessHeap SetConsoleCtrlHandler DuplicateHandle GetQueuedCompletionStatusEx GetConsoleMode SetConsoleMode Sleep RegisterWaitForSingleObject GetBinaryTypeW CreateIoCompletionPort SetFileCompletionNotificationModes GetLastError GetProcAddress GetConsoleScreenBufferInfo SetConsoleTextAttribute GetFileInformationByHandleEx InitializeSListHead GetSystemTimeAsFileTime FindNextFileW GetTempPathW GetModuleHandleW GetFileType GetFileAttributesW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar ReadConsoleW GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetStdHandle GetEnvironmentStringsW TerminateProcess GetProcessId GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW SetUnhandledExceptionFilter GetFileInformationByHandle RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW WaitForSingleObject CompareStringOrdinal

advapi32

RegCloseKey RegOpenKeyTransactedW RegOpenKeyExW RegQueryValueExW RegCreateKeyTransactedW RegCreateKeyExW

bcryptprimitives

ProcessPrng

ws2_32

getsockopt connect recv send WSASocketW bind WSAIoctl closesocket WSAGetLastError ioctlsocket getaddrinfo select freeaddrinfo WSACleanup WSAStartup

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile NtOpenFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcmp memcpy memmove __C_specific_handler __current_exception __current_exception_context _CxxThrowException memset

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initterm __p___argc _cexit terminate _c_exit _crt_atexit _register_onexit_function _exit _seh_filter_exe _get_initial_narrow_environment _set_app_type __p___argv _initialize_onexit_table _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_2678fd2748ac65b466738263b6a8ab24_akira_cobalt-strike_rusty-stealer_satacom

kernel32

advapi32

bcryptprimitives

ws2_32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic