2026-08-07_bc8705fec030393fb1d308eb3d1e0f8a_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_bc8705fec030393fb1d308eb3d1e0f8a_akira_cobalt-strike_rusty-stealer_satacom
Size 388KB
Sample260808-a3smbswfrf
SHA256 f7eafb9042812c8b16b1e721336f126e8796bff959ff61536649079abc4c5765
MD5 bc8705fec030393fb1d308eb3d1e0f8a
SHA1 86951f4b866b87a023edb8b57db52cb9511310d5
SHA512 9a565656deb2f0fe08ffa67b144c9d26b010b6dad2ac9cabfcad8a008018eeae4248896400219eab1a24363b9bdc91e032d56e8e48745030d4d0b054ae62e282
SSDEEP 6144:8R0ZLrYZhuYaPxTm6kbGAURIMFa7m3xXUwueCDkUvJb5i8aK5GLfztHtjOM1V/79:fkq+bSvnDB
TLSH
T180846A57F64294F9E997C0B78322D773BA73708C0B1279EB05A842283E55EE47B39724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_bc8705fec030393fb1d308eb3d1e0f8a_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-07_bc8705fec030393fb1d308eb3d1e0f8a_akira_cobalt-strike_rusty-stealer_satacom

.exe 388KB

2026-08-07_bc8705fec030393fb1d308eb3d1e0f8a_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 70b7fc8cef6c35e6fc3b37bb4a860cc9
SHA256 f7eafb9042812c8b16b1e721336f126e8796bff959ff61536649079abc4c5765
MD5 bc8705fec030393fb1d308eb3d1e0f8a
SHA1 86951f4b866b87a023edb8b57db52cb9511310d5
SHA512 9a565656deb2f0fe08ffa67b144c9d26b010b6dad2ac9cabfcad8a008018eeae4248896400219eab1a24363b9bdc91e032d56e8e48745030d4d0b054ae62e282
SSDEEP 6144:8R0ZLrYZhuYaPxTm6kbGAURIMFa7m3xXUwueCDkUvJb5i8aK5GLfztHtjOM1V/79:fkq+bSvnDB
TLSH
T180846A57F64294F9E997C0B78322D773BA73708C0B1279EB05A842283E55EE47B39724
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

253200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

GetVersionExW FreeLibrary SetHandleInformation LoadLibraryW GetModuleHandleW GetTickCount64 LoadLibraryA GetSystemTimeAsFileTime HeapAlloc GetModuleHandleA GetModuleFileNameW GetLastError HeapFree SetLastError CloseHandle GetProcessHeap GetProcAddress HeapReAlloc ReleaseMutex SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFullPathNameW GetFinalPathNameByHandleW GetTempPathW ExitProcess CreateThread QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId SwitchToThread GetFileSizeEx GetCurrentProcessId CreateMutexA WriteFile CreateDirectoryW GetVolumeInformationA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW DeleteFileW CreateProcessW CreateFileW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

secur32

FreeContextBuffer QueryContextAttributesW InitializeSecurityContextW DecryptMessage EncryptMessage AcquireCredentialsHandleA AcceptSecurityContext FreeCredentialsHandle DeleteSecurityContext

crypt32

CertAddCertificateContextToStore CertOpenStore CertGetCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertEnumCertificatesInStore CertDuplicateStore CertFreeCertificateChain CertDuplicateCertificateChain CertVerifyCertificateChainPolicy

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptSetProperty BCryptGenerateSymmetricKey BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptDecrypt

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shell32

SHGetFolderPathW

ws2_32

closesocket recv setsockopt getaddrinfo freeaddrinfo WSASocketW ioctlsocket connect select getsockopt WSAStartup WSACleanup getsockname getpeername WSAGetLastError send

vcruntime140

memcmp __CxxFrameHandler3 memcpy memset memmove __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _seh_filter_exe _get_initial_narrow_environment _initterm _c_exit _initterm_e exit _exit _initialize_narrow_environment __p___argc terminate __p___argv _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_bc8705fec030393fb1d308eb3d1e0f8a_akira_cobalt-strike_rusty-stealer_satacom

kernel32

secur32

crypt32

bcrypt

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic