2026-08-04_619ab8f3d377ea9a11b0195ce1b120e5_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_619ab8f3d377ea9a11b0195ce1b120e5_akira_cobalt-strike_rusty-stealer_satacom
Size 388KB
Sample260804-hv96eaeh64
SHA256 38de1c2b3c6d6ef87db54082679bcc4d650c6df39d430d4991b3627caffbeb4b
MD5 619ab8f3d377ea9a11b0195ce1b120e5
SHA1 2ee0e6d7c6229eb48af79a66e1033aa0a763fee3
SHA512 fc2fc6ea03194cf09dee79c83a09924b79e432b4f4798c4bd4aaab156688bc0e538e6f96c30f4db47ef6c81e54d6029fca7a472ce028cc10bef0f5ef0fecbbe0
SSDEEP 6144:8R0ZLrYZhuYaPxTm6kbGAURIMFa7m3xXUwueCDkUvJb5i8aK5GLfztHtjOM1V/v9:fkq+bSvnDl
TLSH
T131846A67F64294F9E997C0778322D773BA73708C0B1279EB05A842283E55EE47B39724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_619ab8f3d377ea9a11b0195ce1b120e5_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-04_619ab8f3d377ea9a11b0195ce1b120e5_akira_cobalt-strike_rusty-stealer_satacom

.exe 388KB

2026-08-04_619ab8f3d377ea9a11b0195ce1b120e5_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 70b7fc8cef6c35e6fc3b37bb4a860cc9
SHA256 38de1c2b3c6d6ef87db54082679bcc4d650c6df39d430d4991b3627caffbeb4b
MD5 619ab8f3d377ea9a11b0195ce1b120e5
SHA1 2ee0e6d7c6229eb48af79a66e1033aa0a763fee3
SHA512 fc2fc6ea03194cf09dee79c83a09924b79e432b4f4798c4bd4aaab156688bc0e538e6f96c30f4db47ef6c81e54d6029fca7a472ce028cc10bef0f5ef0fecbbe0
SSDEEP 6144:8R0ZLrYZhuYaPxTm6kbGAURIMFa7m3xXUwueCDkUvJb5i8aK5GLfztHtjOM1V/v9:fkq+bSvnDl
TLSH
T131846A67F64294F9E997C0778322D773BA73708C0B1279EB05A842283E55EE47B39724
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

253200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

GetVersionExW FreeLibrary SetHandleInformation LoadLibraryW GetModuleHandleW GetTickCount64 LoadLibraryA GetSystemTimeAsFileTime HeapAlloc GetModuleHandleA GetModuleFileNameW GetLastError HeapFree SetLastError CloseHandle GetProcessHeap GetProcAddress HeapReAlloc ReleaseMutex SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFullPathNameW GetFinalPathNameByHandleW GetTempPathW ExitProcess CreateThread QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId SwitchToThread GetFileSizeEx GetCurrentProcessId CreateMutexA WriteFile CreateDirectoryW GetVolumeInformationA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW DeleteFileW CreateProcessW CreateFileW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

secur32

FreeContextBuffer QueryContextAttributesW InitializeSecurityContextW DecryptMessage EncryptMessage AcquireCredentialsHandleA AcceptSecurityContext FreeCredentialsHandle DeleteSecurityContext

crypt32

CertAddCertificateContextToStore CertOpenStore CertGetCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertEnumCertificatesInStore CertDuplicateStore CertFreeCertificateChain CertDuplicateCertificateChain CertVerifyCertificateChainPolicy

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptSetProperty BCryptGenerateSymmetricKey BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptDecrypt

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shell32

SHGetFolderPathW

ws2_32

closesocket recv setsockopt getaddrinfo freeaddrinfo WSASocketW ioctlsocket connect select getsockopt WSAStartup WSACleanup getsockname getpeername WSAGetLastError send

vcruntime140

memcmp __CxxFrameHandler3 memcpy memset memmove __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _seh_filter_exe _get_initial_narrow_environment _initterm _c_exit _initterm_e exit _exit _initialize_narrow_environment __p___argc terminate __p___argv _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_619ab8f3d377ea9a11b0195ce1b120e5_akira_cobalt-strike_rusty-stealer_satacom

kernel32

secur32

crypt32

bcrypt

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic