f0454ebcf62575635a9cb19e6aef9306d6597cd29fd8e8ef63d57923551a0a99

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 311KB
Sample260804-hprf4stcqb
SHA256 f0454ebcf62575635a9cb19e6aef9306d6597cd29fd8e8ef63d57923551a0a99
MD5 6caa571186d23647f16c67670d94e276
SHA1 31119852fc3c6316d9bb5ed65e419f7805bffa4b
SHA512 e2d6ca2e23999d72788ecb66997ee795641e71ea536fa6db4995ee0ead76bba866bf2724c64037e5052b31bea9d31b6bd031e45cc062986f9a8359feb119253b
SSDEEP 6144:/rKZ1uGza22QstCod7mDVl0vyJcGYqgSwN3rliYB02t:+Z1uDtZl702t
TLSH
T1BC643B11BE4559A9D44BC47883868AB3A53270CB1F35E9FF06D501783F6EAF96F38218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
552	2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom.exe
552	2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads