2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom
Size 428KB
Sample260808-2pn6jawblh
SHA256 ad015c018476488d2569b1da5406b06cbd08638c00de7f492a43a5aa0faf7d5f
MD5 848d8c0cdddabac42cc6609b8f3f6567
SHA1 72896f2dea1338985c90bc35249678f0d05c9a3b
SHA512 0045425f97a09f3643d11c6fac7dabca452814cf7dc170b8d916447b0d0ce056f6748815c32d2c7db6f1677cecc3b554850a1fbe901a21798ec46d59c3a7a4bb
SSDEEP 6144:UGcwl8PdipMsOKC2Jl8LXOut1DTChjPWIHG7p9kuQ5HHpZGtjhZ3mNFu+/WmNG7w:UG/PhoFCJOvkuQ5HeDILu+/Wm438
TLSH
T10A94AE22BA595CB8D457C07883458A636D7278CA0F31E8FF02D895352E6BAE57F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom

.exe 428KB

2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 41ad4be807a6d9ad3e64ed0add059440
SHA256 ad015c018476488d2569b1da5406b06cbd08638c00de7f492a43a5aa0faf7d5f
MD5 848d8c0cdddabac42cc6609b8f3f6567
SHA1 72896f2dea1338985c90bc35249678f0d05c9a3b
SHA512 0045425f97a09f3643d11c6fac7dabca452814cf7dc170b8d916447b0d0ce056f6748815c32d2c7db6f1677cecc3b554850a1fbe901a21798ec46d59c3a7a4bb
SSDEEP 6144:UGcwl8PdipMsOKC2Jl8LXOut1DTChjPWIHG7p9kuQ5HHpZGtjhZ3mNFu+/WmNG7w:UG/PhoFCJOvkuQ5HeDILu+/Wm438
TLSH
T10A94AE22BA595CB8D457C07883458A636D7278CA0F31E8FF02D895352E6BAE57F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

98:da:db:fb:99:40:31:79:ba:0f:57:ca:a5:83:ff:17:b3:fd:c4:90:27:73:27:ed:0b:1b:d1:7b:e8:85:f1:cc

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2026

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:40:2a:4a:d7:d2:31:21:a6:15:00:00:00:00:05:40

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 18, 2025 - Sep 8, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

180892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stub.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

GetFileAttributesW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CloseHandle WaitForSingleObject GetStdHandle GetLastError GetConsoleMode WideCharToMultiByte AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW FormatMessageW GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx ReadConsoleW CreateDirectoryW CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetModuleFileNameW DuplicateHandle CreateThread QueryPerformanceCounter

ntdll

NtOpenFile NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtReadFile

vcruntime140

__C_specific_handler memcmp __CxxFrameHandler3 __current_exception_context memcpy memset memmove __current_exception

api-ms-win-crt-runtime-l1-1-0

_initterm _configure_narrow_argv exit _exit _get_initial_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_848d8c0cdddabac42cc6609b8f3f6567_akira_cobalt-strike_rusty-stealer_satacom

PE Signature issue

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic