2026-08-04_4d94fcba17b92aa539f97bc56cc914bb_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_4d94fcba17b92aa539f97bc56cc914bb_akira_cobalt-strike_rusty-stealer_satacom
Size 362KB
Sample260804-h7cexafb74
SHA256 da2f80000116f617dd646362e7f2998e1a606c8f5e4c36c9201ca0c09a4165d7
MD5 4d94fcba17b92aa539f97bc56cc914bb
SHA1 db5f3e4ceeb201598cc949a4334143fc06154815
SHA512 fe7be30c832261e726c9aa2d8d7307ecf8d61ff89c21695ae02d2809aa5a20ad0429a77b9c8308e60f8dc401902b11cc9083082a5e7542674c8ba4a941d5e833
SSDEEP 6144:uCxDS3QuEq3zTCgKx5f5qjfbzcM1+CZVTS0MMQA:ueSAuEQ+gWBCx/
TLSH
T10D746C2BF68504F8D9D7C0BA8317CB73B63670CC0F6265FB16E842141E59AA97B39718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_4d94fcba17b92aa539f97bc56cc914bb_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-04_4d94fcba17b92aa539f97bc56cc914bb_akira_cobalt-strike_rusty-stealer_satacom

.exe 362KB

2026-08-04_4d94fcba17b92aa539f97bc56cc914bb_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH ab79066d97254e8cbfb7cb51cdc81bb0
SHA256 da2f80000116f617dd646362e7f2998e1a606c8f5e4c36c9201ca0c09a4165d7
MD5 4d94fcba17b92aa539f97bc56cc914bb
SHA1 db5f3e4ceeb201598cc949a4334143fc06154815
SHA512 fe7be30c832261e726c9aa2d8d7307ecf8d61ff89c21695ae02d2809aa5a20ad0429a77b9c8308e60f8dc401902b11cc9083082a5e7542674c8ba4a941d5e833
SSDEEP 6144:uCxDS3QuEq3zTCgKx5f5qjfbzcM1+CZVTS0MMQA:ueSAuEQ+gWBCx/
TLSH
T10D746C2BF68504F8D9D7C0BA8317CB73B63670CC0F6265FB16E842141E59AA97B39718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

SetHandleInformation GetModuleFileNameW HeapReAlloc LoadLibraryA HeapAlloc SetLastError GetSystemTimeAsFileTime HeapFree CloseHandle GetModuleHandleA GetProcAddress GetProcessHeap FreeLibrary GetModuleHandleW GetLastError ReleaseMutex SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFinalPathNameByHandleW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte CreateMutexA GetCurrentProcessId lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId CreateThread GetFileSizeEx WriteFile CreateDirectoryW GetFileAttributesW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW DeleteFileW CreateFileW SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptGenRandom BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptGetProperty BCryptHashData BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

advapi32

SystemFunction036

secur32

QueryContextAttributesW FreeContextBuffer EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext DecryptMessage

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateStore CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

closesocket getpeername getsockname WSACleanup WSAStartup getsockopt setsockopt select connect ioctlsocket WSASocketW freeaddrinfo getaddrinfo recv send WSAGetLastError

vcruntime140

memcpy __current_exception_context __current_exception __C_specific_handler memset memmove memcmp __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _seh_filter_exe _c_exit _cexit __p___argv _initialize_onexit_table terminate __p___argc _crt_atexit _register_onexit_function _initterm _initterm_e exit _register_thread_local_exe_atexit_callback _exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_4d94fcba17b92aa539f97bc56cc914bb_akira_cobalt-strike_rusty-stealer_satacom

kernel32

bcrypt

advapi32

secur32

crypt32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic