2026-08-05_df0110bc3b65b11f8fd7addd2ab6fa71_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_df0110bc3b65b11f8fd7addd2ab6fa71_akira_cobalt-strike_rusty-stealer_satacom
Size 6.0MB
Sample260805-vtmpya1hla
SHA256 378a084fd2ddf6b520159d079a71deda0d208f019582e3c968365246b3bd45fe
MD5 df0110bc3b65b11f8fd7addd2ab6fa71
SHA1 68ceb755b95544308f7d4a191b1ba9d83b6921a9
SHA512 83c38d8eafc0fe31cb6cfeea13c4cb4cfe77a67c7c6cfd5a95821123787e0257c60fd8d56285730eb7c528c6eab6225fb933152d4b98641651b40c876fafc01c
SSDEEP 98304:caOqz3+mo3Wl1j+TSmr6VqQqrE5vbIH+:X+WvgQqqy
TLSH
T121567D03F36291ECC11AC4749355A233EB62BC491B3576EF5BD47A203EA6FD05A2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_df0110bc3b65b11f8fd7addd2ab6fa71_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-05_df0110bc3b65b11f8fd7addd2ab6fa71_akira_cobalt-strike_rusty-stealer_satacom

.exe 6.0MB

2026-08-05_df0110bc3b65b11f8fd7addd2ab6fa71_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 2040fd927b35562fcfdf079a2c7f3fef
SHA256 378a084fd2ddf6b520159d079a71deda0d208f019582e3c968365246b3bd45fe
MD5 df0110bc3b65b11f8fd7addd2ab6fa71
SHA1 68ceb755b95544308f7d4a191b1ba9d83b6921a9
SHA512 83c38d8eafc0fe31cb6cfeea13c4cb4cfe77a67c7c6cfd5a95821123787e0257c60fd8d56285730eb7c528c6eab6225fb933152d4b98641651b40c876fafc01c
SSDEEP 98304:caOqz3+mo3Wl1j+TSmr6VqQqrE5vbIH+:X+WvgQqqy
TLSH
T121567D03F36291ECC11AC4749355A233EB62BC491B3576EF5BD47A203EA6FD05A2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3530140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

kernel32

HeapAlloc DeleteFileW SetFileInformationByHandle HeapReAlloc HeapFree DuplicateHandle GetModuleHandleA LoadLibraryW GlobalFree GetSystemTimePreciseAsFileTime SetHandleInformation FormatMessageW GetProcAddress SetLastError GetLastError FreeLibrary LoadLibraryA GetProcessHeap GetComputerNameW GetSystemTimeAsFileTime GlobalMemoryStatusEx GetCurrentProcessId GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle WaitForSingleObject GetCurrentThread GlobalUnlock GetCurrentThreadId SwitchToThread GlobalLock GlobalSize SetWaitableTimer CreateWaitableTimerExW GlobalAlloc GetTempPathW FindClose SetThreadErrorMode GetQueuedCompletionStatusEx FindFirstFileExW SetFileTime PostQueuedCompletionStatus ReadFile GetOverlappedResult GetFullPathNameW CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile CancelIoEx Sleep LoadLibraryExW GetModuleFileNameW CreateThread CloseHandle GetModuleHandleW GetCurrentProcess CreateFileW ExitProcess GetFileAttributesW CreateProcessW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW WriteFileEx SleepEx ReadFileEx GetWindowsDirectoryW GetSystemInfo InitializeSListHead RtlVirtualUnwind GetCurrentDirectoryW CompareStringOrdinal FreeEnvironmentStringsW QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetEnvironmentStringsW SetUnhandledExceptionFilter

user32

GetClassNameW ShowWindow SetCursor LoadCursorW GetClassInfoExW GetMenu SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow SetWindowPlacement GetWindowPlacement GetSystemMenu ChangeDisplaySettingsExW FlashWindowEx SetWindowDisplayAffinity SetWindowTextW SetCursorPos EnableMenuItem GetWindowTextLengthW MonitorFromWindow GetWindowRect CreateIcon SetWindowLongW ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx ToUnicodeEx AdjustWindowRectEx GetWindowLongW ShowCursor ClipCursor GetClipCursor TrackMouseEvent SetCapture MonitorFromRect IsIconic CreateIconFromResourceEx SendMessageW GetActiveWindow GetClientRect SystemParametersInfoA DestroyCursor IsWindowVisible MonitorFromPoint GetMonitorInfoW EnumDisplayMonitors RemovePropW PostMessageW RegisterWindowMessageA RedrawWindow DestroyWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowLongPtrW InvalidateRgn SetWindowPos RegisterRawInputDevices CreateWindowExW RegisterClassExW DestroyIcon DefWindowProcW GetCursorPos ReleaseCapture GetKeyboardState GetAsyncKeyState ClientToScreen ScreenToClient ReleaseDC GetKeyboardLayout MapVirtualKeyExW GetSystemMetrics IsProcessDPIAware GetKeyState GetWindowTextW CallWindowProcW SetWindowLongPtrW SetPropW GetPropW GetDC CloseClipboard SetClipboardData RegisterTouchWindow GetTouchInputInfo CloseTouchInputHandle GetClipboardData IsClipboardFormatAvailable RegisterClipboardFormatW OpenClipboard EmptyClipboard

gdi32

CreateCompatibleDC BitBlt GetDIBits CreateRectRgn SelectObject DeleteDC DeleteObject GetDeviceCaps CreateCompatibleBitmap ChoosePixelFormat SetPixelFormat DescribePixelFormat SwapBuffers

ntdll

NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile

uiautomationcore

UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaLookupId

oleaut32

SetErrorInfo SysAllocStringLen GetErrorInfo VariantClear SysStringLen SafeArrayPutElement SafeArrayCreateVector

ole32

CoCreateFreeThreadedMarshaler OleInitialize RevokeDragDrop CoInitializeEx CoCreateInstance CoUninitialize RegisterDragDrop

ws2_32

WSASend shutdown freeaddrinfo getaddrinfo WSACleanup WSAStartup getsockopt bind WSAIoctl ioctlsocket WSASocketW setsockopt getsockname connect recv closesocket WSAGetLastError send getpeername

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW

crypt32

CertFreeCertificateChain CertDuplicateCertificateChain CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateContext CertAddCertificateContextToStore CertDuplicateCertificateContext CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

RevertToSelf SystemFunction036 GetUserNameW ImpersonateAnonymousToken RegGetValueW

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

shell32

DragFinish DragQueryFileW

opengl32

wglCreateContext wglShareLists wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglGetCurrentDC

imm32

ImmSetCompositionWindow ImmAssociateContextEx ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmGetCompositionStringW

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

vcruntime140

memcpy memcmp memmove memset __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

round acosf cbrtf fmod truncf exp2f cos pow floor trunc sin roundf __setusermatherr sinf ceilf floorf expf atan2f _hypotf cosf powf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argc _initialize_narrow_environment _get_initial_narrow_environment strerror _initterm_e _initterm _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xta

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xha

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xea

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xda

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xva

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.txd

Size

512B

Virtual Size

326B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_df0110bc3b65b11f8fd7addd2ab6fa71_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

user32

gdi32

ntdll

uiautomationcore

oleaut32

ole32

ws2_32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

advapi32

shlwapi

bcrypt

shell32

opengl32

imm32

dwmapi

uxtheme

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic