2026-08-06_c9fe2bad3b8aa13e1fdf76b372e106c2_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_c9fe2bad3b8aa13e1fdf76b372e106c2_akira_cobalt-strike_rusty-stealer_satacom
Size 6.0MB
Sample260806-g91d3seq7x
SHA256 94d5c3163e87bc1d5b13d57422daf4c16b41321d4845d51beec1d1bdeca3a807
MD5 c9fe2bad3b8aa13e1fdf76b372e106c2
SHA1 b7fb6b50628e0dca07a4aecaea01b76530ec84f2
SHA512 8900474fb107bb8d4f4f3201d6804130af6fa9afbd0c26540e3083fd96c4347a9fa2ff060beff8c7f51b57c68fb5da70aac7974b86a4231b722309de7d586571
SSDEEP 98304:MDfB9hzso+LlmdgBu7lkn5qzrQn2sbbH+eg:qzNd6ozr7GVg
TLSH
T143567D03F2A291ECC11AC4749315B233EB62BC491B3476EF5BD47A203E66FD05A2DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_c9fe2bad3b8aa13e1fdf76b372e106c2_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-06_c9fe2bad3b8aa13e1fdf76b372e106c2_akira_cobalt-strike_rusty-stealer_satacom

.exe 6.0MB

2026-08-06_c9fe2bad3b8aa13e1fdf76b372e106c2_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 6642eb5f8a920d84a0a3d8d320edfaa1
SHA256 94d5c3163e87bc1d5b13d57422daf4c16b41321d4845d51beec1d1bdeca3a807
MD5 c9fe2bad3b8aa13e1fdf76b372e106c2
SHA1 b7fb6b50628e0dca07a4aecaea01b76530ec84f2
SHA512 8900474fb107bb8d4f4f3201d6804130af6fa9afbd0c26540e3083fd96c4347a9fa2ff060beff8c7f51b57c68fb5da70aac7974b86a4231b722309de7d586571
SSDEEP 98304:MDfB9hzso+LlmdgBu7lkn5qzrQn2sbbH+eg:qzNd6ozr7GVg
TLSH
T143567D03F2A291ECC11AC4749315B233EB62BC491B3476EF5BD47A203E66FD05A2DB59
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3542940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

kernel32

GetModuleHandleA DeleteFileW SetFileInformationByHandle HeapReAlloc FormatMessageW LoadLibraryW GlobalFree HeapAlloc HeapFree GetProcessHeap SetLastError SetHandleInformation GetModuleHandleW CloseHandle GetSystemDirectoryW GetModuleFileNameW LoadLibraryExW LoadLibraryA SetThreadErrorMode GetComputerNameW GetSystemInfo GlobalMemoryStatusEx FreeLibrary DuplicateHandle GetCurrentThread GlobalUnlock ExitProcess SwitchToThread GlobalLock GlobalSize GetFileInformationByHandleEx SetWaitableTimer GlobalAlloc CreateWaitableTimerExW GetTempPathW GetFileInformationByHandle GetQueuedCompletionStatusEx FindClose FindFirstFileExW PostQueuedCompletionStatus ReadFile GetOverlappedResult SetFileTime CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile CancelIoEx Sleep WaitForSingleObject GetCurrentProcess GetFileAttributesW CreateProcessW GetFullPathNameW GetLastError GetCurrentThreadId CreateFileW GetProcAddress GetCurrentProcessId GetSystemTimeAsFileTime GetStdHandle GetConsoleMode GetConsoleOutputCP CreateThread WriteConsoleW WriteFileEx SleepEx ReadFileEx GetSystemTimePreciseAsFileTime GetWindowsDirectoryW InitializeSListHead RtlVirtualUnwind GetCurrentDirectoryW CompareStringOrdinal FreeEnvironmentStringsW QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetEnvironmentStringsW SetUnhandledExceptionFilter

user32

GetClassInfoExW GetClassNameW GetKeyboardState SetCursor LoadCursorW GetAsyncKeyState SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow SetWindowPlacement GetWindowPlacement MonitorFromRect ChangeDisplaySettingsExW FlashWindowEx SetWindowDisplayAffinity SetWindowTextW SetCursorPos GetWindowTextW GetWindowTextLengthW MonitorFromWindow GetWindowRect SetCapture TrackMouseEvent GetClipCursor ClipCursor ShowCursor GetWindowLongW GetKeyState AdjustWindowRectEx IsProcessDPIAware ToUnicodeEx GetCursorPos GetRawInputData ValidateRect CreateIcon IsIconic CreateIconFromResourceEx SendMessageW GetActiveWindow GetClientRect SystemParametersInfoA DestroyIcon IsWindowVisible MonitorFromPoint GetMonitorInfoW EnumDisplayMonitors RemovePropW PostMessageW RegisterWindowMessageA RedrawWindow DestroyWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowLongPtrW InvalidateRgn SetWindowPos RegisterRawInputDevices CreateWindowExW RegisterClassExW ShowWindow DefWindowProcW GetSystemMetrics GetDC ReleaseCapture GetSystemMenu ClientToScreen ReleaseDC GetMenu EnableMenuItem MapVirtualKeyExW SetWindowLongW MsgWaitForMultipleObjectsEx GetKeyboardLayout DestroyCursor CallWindowProcW SetWindowLongPtrW SetPropW GetPropW ScreenToClient CloseClipboard SetClipboardData RegisterTouchWindow GetTouchInputInfo CloseTouchInputHandle GetClipboardData IsClipboardFormatAvailable RegisterClipboardFormatW OpenClipboard EmptyClipboard

gdi32

CreateCompatibleBitmap GetDeviceCaps CreateRectRgn SelectObject BitBlt DeleteObject GetDIBits CreateCompatibleDC DeleteDC ChoosePixelFormat SetPixelFormat DescribePixelFormat SwapBuffers

uiautomationcore

UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider

oleaut32

SysAllocStringLen VariantClear SafeArrayPutElement SafeArrayCreateVector SysStringLen GetErrorInfo SetErrorInfo

ole32

CoCreateFreeThreadedMarshaler OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoUninitialize CoInitializeEx

ntdll

NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile NtReadFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile

ws2_32

getsockname WSAGetLastError send setsockopt WSASocketW ioctlsocket closesocket WSAIoctl getpeername bind getsockopt recv WSAStartup WSACleanup getaddrinfo freeaddrinfo shutdown WSASend connect

secur32

FreeCredentialsHandle FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DeleteSecurityContext DecryptMessage EncryptMessage

crypt32

CertGetCertificateChain CertFreeCertificateChain CertDuplicateStore CertFreeCertificateContext CertEnumCertificatesInStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertDuplicateCertificateChain

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

RevertToSelf SystemFunction036 GetUserNameW ImpersonateAnonymousToken RegGetValueW

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

shell32

DragQueryFileW DragFinish

opengl32

wglCreateContext wglShareLists wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglGetCurrentDC

imm32

ImmReleaseContext ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

vcruntime140

memcpy memcmp memmove memset __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

round acosf cbrtf fmod truncf exp2f cos pow floor trunc sin roundf __setusermatherr sinf ceilf floorf expf atan2f _hypotf cosf powf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argc _initialize_narrow_environment _get_initial_narrow_environment strerror _initterm_e _initterm _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xta

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xha

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xea

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xda

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xva

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.txd

Size

512B

Virtual Size

326B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_c9fe2bad3b8aa13e1fdf76b372e106c2_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

user32

gdi32

uiautomationcore

oleaut32

ole32

ntdll

ws2_32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

advapi32

shlwapi

bcrypt

shell32

opengl32

imm32

dwmapi

uxtheme

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic