2026-08-04_193898b5bc102529cc7e5b878ed43ef9_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_193898b5bc102529cc7e5b878ed43ef9_akira_cobalt-strike_rusty-stealer_satacom
Size 392KB
Sample260804-j3cesavcmg
SHA256 5336819c914a35215d9737b460b999cc74fb811619fad7c62b11a24808deb80b
MD5 193898b5bc102529cc7e5b878ed43ef9
SHA1 89926c02f1b95869e41ddb90fb83a2a2d30e437c
SHA512 077bd3eb3a9915dd4b36681276cdac495b4cb89b6223c436a8ffcb5217d32bbd834dfc7d61e7c78b536856ac67ef9523c34125b62b4d64f0abf60db5194f3a8a
SSDEEP 6144:C4sm7mYNoZRzubZoRTxR1f05AoxUb6gTueCDkUvJb5i8aK5GLfztHtjOM1VMSG+b:NdNO9crq
TLSH
T186846B66F65294F8E997C0B6C317C773BA36708C0B5279EB05A852383D15BD8BB38724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_193898b5bc102529cc7e5b878ed43ef9_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-04_193898b5bc102529cc7e5b878ed43ef9_akira_cobalt-strike_rusty-stealer_satacom

.exe 392KB

2026-08-04_193898b5bc102529cc7e5b878ed43ef9_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH e166af5a6fe9a96e49c60c12db3162d2
SHA256 5336819c914a35215d9737b460b999cc74fb811619fad7c62b11a24808deb80b
MD5 193898b5bc102529cc7e5b878ed43ef9
SHA1 89926c02f1b95869e41ddb90fb83a2a2d30e437c
SHA512 077bd3eb3a9915dd4b36681276cdac495b4cb89b6223c436a8ffcb5217d32bbd834dfc7d61e7c78b536856ac67ef9523c34125b62b4d64f0abf60db5194f3a8a
SSDEEP 6144:C4sm7mYNoZRzubZoRTxR1f05AoxUb6gTueCDkUvJb5i8aK5GLfztHtjOM1VMSG+b:NdNO9crq
TLSH
T186846B66F65294F8E997C0B6C317C773BA36708C0B5279EB05A852383D15BD8BB38724
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

256096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

HeapReAlloc GetModuleHandleA GetModuleFileNameW HeapAlloc GetSystemTimeAsFileTime GetTickCount64 HeapFree LoadLibraryA SetLastError LoadLibraryW GetModuleHandleW GetLastError GetProcAddress GetVersionExW FreeLibrary SetHandleInformation CloseHandle GetProcessHeap GetStdHandle SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFinalPathNameByHandleW GetTempPathW ExitProcess GetFileInformationByHandleEx GetFileInformationByHandle FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW CreateThread QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode RtlVirtualUnwind WideCharToMultiByte ReleaseMutex CreateMutexA lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId SwitchToThread GetFileSizeEx GetCurrentProcessId WriteFile CreateDirectoryW GetVolumeInformationA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW DeleteFileW CreateProcessW CreateFileW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

secur32

EncryptMessage DecryptMessage DeleteSecurityContext FreeCredentialsHandle AcceptSecurityContext InitializeSecurityContextW FreeContextBuffer QueryContextAttributesW AcquireCredentialsHandleA

crypt32

CertFreeCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertCloseStore CertDuplicateCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertDuplicateStore CertOpenStore

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGetProperty

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shell32

SHGetFolderPathW

ws2_32

send getpeername getsockname WSACleanup WSAStartup getsockopt select connect ioctlsocket WSASocketW freeaddrinfo getaddrinfo setsockopt recv closesocket WSAGetLastError

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception __C_specific_handler memmove memset memcpy memcmp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argc _exit exit _initterm_e _initterm __p___argv _initialize_narrow_environment _configure_narrow_argv _cexit _set_app_type _seh_filter_exe _c_exit _register_thread_local_exe_atexit_callback _crt_atexit terminate _get_initial_narrow_environment _register_onexit_function _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_193898b5bc102529cc7e5b878ed43ef9_akira_cobalt-strike_rusty-stealer_satacom

kernel32

secur32

crypt32

bcrypt

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic