2026-08-04_91dfa198a5d582ccfa6774955f306ccc_akira_cobalt-strike_rusty-stealer_satacom_zxxz

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_91dfa198a5d582ccfa6774955f306ccc_akira_cobalt-strike_rusty-stealer_satacom_zxxz
Size 3.5MB
Sample260804-g2jrcsec97
SHA256 7fb8272bb1f1d0c72fd33c11fd696ca68522b01c7fd63afd6ad39958b3bb4659
MD5 91dfa198a5d582ccfa6774955f306ccc
SHA1 ca123c8f77c0bc7aa745ecca0ac6e2de2687dcf6
SHA512 cae599e4e80ad5b19efe041157336497ebdae500731d5463c5e5d919f358d3b6385ae88450ccdc0023dadc53a7705e5ceb56b73667979f548f98e9ee5f3ad913
SSDEEP 49152:0QtwKcaUwaaAcIEsjzFBHmjsJtMhCnXzXby+Gb5aaKRcPJcptrPd3Xb:1wKc9RtrBWztPqtDdb
TLSH
T1B30629627B5E95A9C15BC07482478A765A3130CB0F36A9FF408856782FBEEF51F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_91dfa198a5d582ccfa6774955f306ccc_akira_cobalt-strike_rusty-stealer_satacom_zxxz

File Explorer

2026-08-04_91dfa198a5d582ccfa6774955f306ccc_akira_cobalt-strike_rusty-stealer_satacom_zxxz

.exe 3.5MB

2026-08-04_91dfa198a5d582ccfa6774955f306ccc_akira_cobalt-strike_rusty-stealer_satacom_zxxz

IMPHASH 6d680701cd96d80ef54256b9a80367f9
SHA256 7fb8272bb1f1d0c72fd33c11fd696ca68522b01c7fd63afd6ad39958b3bb4659
MD5 91dfa198a5d582ccfa6774955f306ccc
SHA1 ca123c8f77c0bc7aa745ecca0ac6e2de2687dcf6
SHA512 cae599e4e80ad5b19efe041157336497ebdae500731d5463c5e5d919f358d3b6385ae88450ccdc0023dadc53a7705e5ceb56b73667979f548f98e9ee5f3ad913
SSDEEP 49152:0QtwKcaUwaaAcIEsjzFBHmjsJtMhCnXzXby+Gb5aaKRcPJcptrPd3Xb:1wKc9RtrBWztPqtDdb
TLSH
T1B30629627B5E95A9C15BC07482478A765A3130CB0F36A9FF408856782FBEEF51F38358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2328368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

komersa.pdb

ntdll

NtOpenFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError

kernel32

GetConsoleMode CloseHandle GetProcAddress GetLastError Sleep GetModuleHandleA GetFileInformationByHandle GetSystemTimeAsFileTime GetFileAttributesW FreeLibrary SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive RtlUnwindEx GetTempPathW SetWaitableTimer RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx ReleaseSRWLockExclusive DeleteCriticalSection GetModuleHandleW GetCurrentThreadId lstrlenW GetUserDefaultUILanguage LCIDToLocaleName LoadLibraryW LoadLibraryA GetModuleFileNameW OutputDebugStringA OutputDebugStringW LoadLibraryExW GetEnvironmentVariableW GetProcessHeap HeapFree WaitForSingleObject FormatMessageW HeapAlloc CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId ReadFileEx GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW SetEnvironmentVariableW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW

bcryptprimitives

ProcessPrng

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

RegQueryValueExW EventRegister EventSetInformation EventWriteTransfer RegGetValueW RegCloseKey SystemFunction036 RegOpenKeyExW EventUnregister

gdi32

DeleteObject GetDeviceCaps CreateRectRgn

ole32

RegisterDragDrop CoInitializeEx CoUninitialize CoTaskMemAlloc CoCreateInstance CreateStreamOnHGlobal CoTaskMemFree RevokeDragDrop OleInitialize

shell32

SHGetKnownFolderPath SHAppBarMessage DragQueryFileW DragFinish

user32

DispatchMessageA GetMessageA ToUnicodeEx VkKeyScanW MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SystemParametersInfoA GetKeyboardLayout GetMessageW GetAncestor TranslateAcceleratorW TranslateMessage DispatchMessageW DestroyWindow CreateWindowExW IsWindow GetSystemMetrics RegisterTouchWindow SetWindowPos InvalidateRgn PostMessageW FlashWindowEx MapVirtualKeyW PostThreadMessageW RedrawWindow DefWindowProcW ChangeDisplaySettingsExW PeekMessageW GetWindowPlacement SetWindowPlacement LoadCursorW SetCursor ValidateRect GetUpdateRect ScreenToClient MonitorFromRect GetTouchInputInfo TrackMouseEvent CloseTouchInputHandle GetWindowLongW GetClientRect ClientToScreen GetCursorPos MonitorFromWindow GetMonitorInfoW SetMenu GetActiveWindow IsIconic ReleaseCapture SetCursorPos GetForegroundWindow EnumChildWindows RegisterClassExW RegisterWindowMessageA RegisterRawInputDevices MsgWaitForMultipleObjectsEx SetCapture SetWindowLongPtrW ShowWindow GetSystemMenu EnableMenuItem SendMessageW SetWindowLongW GetClipCursor ClipCursor ShowCursor DestroyIcon CreateAcceleratorTableW DestroyAcceleratorTable GetDC IsProcessDPIAware CheckMenuItem SetMenuItemInfoW AppendMenuW CreateMenu SendInput PostQuitMessage MonitorFromPoint EnumDisplayMonitors GetRawInputData SetWindowDisplayAffinity GetWindowTextLengthW GetWindowTextW SetWindowTextW GetWindowLongPtrW SetForegroundWindow GetWindowRect CreateIcon IsWindowVisible GetMenu AdjustWindowRectEx

bcrypt

BCryptGenRandom

dwmapi

DwmEnableBlurBehindWindow

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass

ws2_32

WSAStartup closesocket WSACleanup WSAGetLastError setsockopt getsockopt ioctlsocket recv send connect select WSASocketW

uxtheme

SetWindowTheme

api-ms-win-crt-math-l1-1-0

floor trunc __setusermatherr pow round

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _crt_atexit terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _register_onexit_function _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv abort _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc calloc free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_91dfa198a5d582ccfa6774955f306ccc_akira_cobalt-strike_rusty-stealer_satacom_zxxz

ntdll

kernel32

bcryptprimitives

oleaut32

api-ms-win-core-synch-l1-2-0

advapi32

gdi32

ole32

shell32

user32

bcrypt

dwmapi

comctl32

ws2_32

uxtheme

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic