2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom
Size 311KB
Sample260804-hprf4stcqb
SHA256 f0454ebcf62575635a9cb19e6aef9306d6597cd29fd8e8ef63d57923551a0a99
MD5 6caa571186d23647f16c67670d94e276
SHA1 31119852fc3c6316d9bb5ed65e419f7805bffa4b
SHA512 e2d6ca2e23999d72788ecb66997ee795641e71ea536fa6db4995ee0ead76bba866bf2724c64037e5052b31bea9d31b6bd031e45cc062986f9a8359feb119253b
SSDEEP 6144:/rKZ1uGza22QstCod7mDVl0vyJcGYqgSwN3rliYB02t:+Z1uDtZl702t
TLSH
T1BC643B11BE4559A9D44BC47883868AB3A53270CB1F35E9FF06D501783F6EAF96F38218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom

.exe 311KB

2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH c402f4f52f1dedb5b359e02ec584feb2
SHA256 f0454ebcf62575635a9cb19e6aef9306d6597cd29fd8e8ef63d57923551a0a99
MD5 6caa571186d23647f16c67670d94e276
SHA1 31119852fc3c6316d9bb5ed65e419f7805bffa4b
SHA512 e2d6ca2e23999d72788ecb66997ee795641e71ea536fa6db4995ee0ead76bba866bf2724c64037e5052b31bea9d31b6bd031e45cc062986f9a8359feb119253b
SSDEEP 6144:/rKZ1uGza22QstCod7mDVl0vyJcGYqgSwN3rliYB02t:+Z1uDtZl702t
TLSH
T1BC643B11BE4559A9D44BC47883868AB3A53270CB1F35E9FF06D501783F6EAF96F38218
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9f:21:5d:c9:2a:4e:cc:2d:42:b6:bd:9c:91:5c:ea:f2:01:53:d1:35:b0:22:64:c0:12:ca:d7:7b:b7:b9:84:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 31, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

213744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetTickCount CloseHandle GetFileAttributesW GetCurrentProcess GetSystemDirectoryW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread SetHandleInformation GetCurrentProcessId ReadFileEx DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentStringsW GetWindowsDirectoryW CreateProcessW GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex HeapAlloc GetModuleFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP FormatMessageW GetModuleHandleA

ntdll

RtlNtStatusToDosError NtOpenFile NtWriteFile NtCreateNamedPipeFile

ws2_32

recv send connect WSASocketW WSAStartup WSACleanup freeaddrinfo WSAGetLastError getaddrinfo closesocket

advapi32

RegOpenKeyExW RegCloseKey

vcruntime140

memmove __current_exception __CxxFrameHandler3 memset __current_exception_context memcpy _CxxThrowException __C_specific_handler memcmp

api-ms-win-crt-string-l1-1-0

wcscpy_s wcscat_s _wcsicmp wcslen

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _seh_filter_exe _set_app_type _crt_atexit terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_6caa571186d23647f16c67670d94e276_akira_cobalt-strike_rusty-stealer_satacom

PE Signature issue

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic