2026-08-05_3d1ffe7afd134e51f67ce8e0849fc42c_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_3d1ffe7afd134e51f67ce8e0849fc42c_akira_cobalt-strike_rusty-stealer_satacom
Size 923KB
Sample260805-dpklcaal2t
SHA256 985c86ccc837f24e74ce38aa026985417df9f144650c508c07e7f8f9a0136c79
MD5 3d1ffe7afd134e51f67ce8e0849fc42c
SHA1 0a5a6fba755c2688180b8b55bdeb1821d576597e
SHA512 f4d84eef82d7e060e5496dbfea929eae7a08aaa7aba9a3d9e124d11a0afeb6c37617c0c0c29c9d3c9e7c3a45e017e46174365b6aadd3c900834d93c3b331cbd4
SSDEEP 12288:sVlpJ/Y7rA2X4i4ft1bFXgltgFMhS5IttY3reTjD06MlNyLPamAP:kpVkrA20iSFMwVIH06iyTH
TLSH
T1DC15BE43F09641EDC01BD4B8C65B8373FA71B8CD171069F74395E6A82E27AE05E38B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_3d1ffe7afd134e51f67ce8e0849fc42c_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-05_3d1ffe7afd134e51f67ce8e0849fc42c_akira_cobalt-strike_rusty-stealer_satacom

.exe 923KB

2026-08-05_3d1ffe7afd134e51f67ce8e0849fc42c_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH fd224b4c7f4b614f3b0eb0d89b1c18b6
SHA256 985c86ccc837f24e74ce38aa026985417df9f144650c508c07e7f8f9a0136c79
MD5 3d1ffe7afd134e51f67ce8e0849fc42c
SHA1 0a5a6fba755c2688180b8b55bdeb1821d576597e
SHA512 f4d84eef82d7e060e5496dbfea929eae7a08aaa7aba9a3d9e124d11a0afeb6c37617c0c0c29c9d3c9e7c3a45e017e46174365b6aadd3c900834d93c3b331cbd4
SSDEEP 12288:sVlpJ/Y7rA2X4i4ft1bFXgltgFMhS5IttY3reTjD06MlNyLPamAP:kpVkrA20iSFMwVIH06iyTH
TLSH
T1DC15BE43F09641EDC01BD4B8C65B8373FA71B8CD171069F74395E6A82E27AE05E38B96
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

582704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

injector_cli.pdb

kernel32

GetModuleFileNameW GetFileInformationByHandleEx SetFileInformationByHandle GetCurrentProcess WaitForSingleObject SetFileTime lstrlenW LoadLibraryA GetModuleHandleW GetCurrentThreadId GetFullPathNameW GetConsoleMode GetFileInformationByHandle CreateRemoteThread WriteProcessMemory VirtualAllocEx IsWow64Process CreateFileW OpenProcess VirtualFreeEx GetModuleHandleA GetProcAddress FormatMessageW GetLastError ReleaseMutex GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer HeapFree HeapAlloc GetProcessHeap CloseHandle InitializeCriticalSectionEx RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetConsoleOutputCP WriteConsoleW RtlVirtualUnwind GetEnvironmentVariableW SetLastError HeapReAlloc MultiByteToWideChar QueryPerformanceCounter GetCurrentProcessId RtlCaptureContext RtlLookupFunctionEntry GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW FindFirstFileExW FindClose ExitProcess WideCharToMultiByte WaitForSingleObjectEx CreateMutexA GetFinalPathNameByHandleW DeleteCriticalSection

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-heap-l1-1-0

free calloc malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

_initterm _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _initterm_e _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type abort _seh_filter_exe exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_3d1ffe7afd134e51f67ce8e0849fc42c_akira_cobalt-strike_rusty-stealer_satacom

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic