2026-08-04_076821428bfcbfc5685daa2c56af1ed0_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_076821428bfcbfc5685daa2c56af1ed0_akira_cobalt-strike_rusty-stealer_satacom
Size 370KB
Sample260804-kftafsgb68
SHA256 9484a04a7694303684e6fc00e1e7fa5735075760ea37a813710f191ae1def0d4
MD5 076821428bfcbfc5685daa2c56af1ed0
SHA1 86f81aae4dcc9ea4018c237ed7a00e5a33270029
SHA512 bf580c5523ff6bf57338443dd3009d0c21adb0d355bb5f96784759b690350f9baa47044584d84bfe41e207485ea3fdbca4917644192b30e39b29cff3e8295baf
SSDEEP 6144:eWjwopPWR2QfLeAJIjpV8oZWKmLu26a1:38kvcLuq
TLSH
T169846B57F61294FCE99BC0B78317D7737A77708C4B1278EB05A842283D16AA97B38724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_076821428bfcbfc5685daa2c56af1ed0_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-04_076821428bfcbfc5685daa2c56af1ed0_akira_cobalt-strike_rusty-stealer_satacom

.exe 370KB

2026-08-04_076821428bfcbfc5685daa2c56af1ed0_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 08f0d923288ef89680d27c03de718dbc
SHA256 9484a04a7694303684e6fc00e1e7fa5735075760ea37a813710f191ae1def0d4
MD5 076821428bfcbfc5685daa2c56af1ed0
SHA1 86f81aae4dcc9ea4018c237ed7a00e5a33270029
SHA512 bf580c5523ff6bf57338443dd3009d0c21adb0d355bb5f96784759b690350f9baa47044584d84bfe41e207485ea3fdbca4917644192b30e39b29cff3e8295baf
SSDEEP 6144:eWjwopPWR2QfLeAJIjpV8oZWKmLu26a1:38kvcLuq
TLSH
T169846B57F61294FCE99BC0B78317D7737A77708C4B1278EB05A842283D16AA97B38724
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

232688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

GetCommandLineW SetEnvironmentVariableW GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc CreateFileW CloseHandle CreateProcessW DeleteFileW MoveFileExW GetFileAttributesW FindFirstFileW FindNextFileW FindClose RemoveDirectoryW GetVolumeInformationA CreateDirectoryW WriteFile SetLastError CreateMutexA GetTickCount64 GetCurrentProcessId GetFileSizeEx LoadLibraryW GetProcAddress FreeLibrary SwitchToThread GetProcessHeap GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter CreateThread GetModuleHandleA ExitProcess GetModuleFileNameW GetTempPathW GetFinalPathNameByHandleW GetFullPathNameW CreateWaitableTimerExW SetWaitableTimer Sleep SetUnhandledExceptionFilter HeapFree GetSystemTimeAsFileTime SetHandleInformation InitializeSListHead

bcrypt

BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptDestroyKey BCryptGetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptCreateHash BCryptOpenAlgorithmProvider BCryptFinishHash

advapi32

RegOpenKeyExW RegCloseKey AllocateAndInitializeSid FreeSid OpenProcessToken CheckTokenMembership RegQueryValueExW

ntdll

NtWriteFile RtlNtStatusToDosError

shell32

SHGetFolderPathW

ws2_32

select connect ioctlsocket WSASocketW freeaddrinfo getsockopt WSACleanup WSAStartup recv WSAGetLastError setsockopt closesocket send getaddrinfo

vcruntime140

__current_exception_context __current_exception __C_specific_handler memmove memset __CxxFrameHandler3 memcpy memcmp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit terminate _register_thread_local_exe_atexit_callback _register_onexit_function _crt_atexit _seh_filter_exe _set_app_type _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _cexit __p___argc __p___argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_076821428bfcbfc5685daa2c56af1ed0_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

bcrypt

advapi32

ntdll

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic