2026-08-07_b55325af814bda8ca27dc1c3b756b5d8_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_b55325af814bda8ca27dc1c3b756b5d8_akira_cobalt-strike_rusty-stealer_satacom
Size 388KB
Sample260808-a46wcaep91
SHA256 60520cb8ade70ca3513ae230193d98dc2ada5320b9d710f82c0603224e7b40cc
MD5 b55325af814bda8ca27dc1c3b756b5d8
SHA1 ff0d141857ea2c9e6834e3e9fcb137d769974696
SHA512 18956fecc9a2a54ac7f23edc70f8f9ca59b26160cd21ec226b6a16b9c108f505d1e0efc23816856d639e4e79316abd51816beada7c2fc7323a0318d332feeb14
SSDEEP 6144:8R0ZLrYZhuYaPxTm6kbGAURIMFa7m3xXUcueCDkUvJb5i8aK5GLfztHtjOM1VgtB:fkq+bSvncn
TLSH
T1B4846A57F24294F9E997C077C326D773BA7370880B1279EB05A842283E55EE47B39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_b55325af814bda8ca27dc1c3b756b5d8_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-07_b55325af814bda8ca27dc1c3b756b5d8_akira_cobalt-strike_rusty-stealer_satacom

.exe 388KB

2026-08-07_b55325af814bda8ca27dc1c3b756b5d8_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 70b7fc8cef6c35e6fc3b37bb4a860cc9
SHA256 60520cb8ade70ca3513ae230193d98dc2ada5320b9d710f82c0603224e7b40cc
MD5 b55325af814bda8ca27dc1c3b756b5d8
SHA1 ff0d141857ea2c9e6834e3e9fcb137d769974696
SHA512 18956fecc9a2a54ac7f23edc70f8f9ca59b26160cd21ec226b6a16b9c108f505d1e0efc23816856d639e4e79316abd51816beada7c2fc7323a0318d332feeb14
SSDEEP 6144:8R0ZLrYZhuYaPxTm6kbGAURIMFa7m3xXUcueCDkUvJb5i8aK5GLfztHtjOM1VgtB:fkq+bSvncn
TLSH
T1B4846A57F24294F9E997C077C326D773BA7370880B1279EB05A842283E55EE47B39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

253200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

GetVersionExW FreeLibrary SetHandleInformation LoadLibraryW GetModuleHandleW GetTickCount64 LoadLibraryA GetSystemTimeAsFileTime HeapAlloc GetModuleHandleA GetModuleFileNameW GetLastError HeapFree SetLastError CloseHandle GetProcessHeap GetProcAddress HeapReAlloc ReleaseMutex SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFullPathNameW GetFinalPathNameByHandleW GetTempPathW ExitProcess CreateThread QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId SwitchToThread GetFileSizeEx GetCurrentProcessId CreateMutexA WriteFile CreateDirectoryW GetVolumeInformationA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW DeleteFileW CreateProcessW CreateFileW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

secur32

FreeContextBuffer QueryContextAttributesW InitializeSecurityContextW DecryptMessage EncryptMessage AcquireCredentialsHandleA AcceptSecurityContext FreeCredentialsHandle DeleteSecurityContext

crypt32

CertAddCertificateContextToStore CertOpenStore CertGetCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertEnumCertificatesInStore CertDuplicateStore CertFreeCertificateChain CertDuplicateCertificateChain CertVerifyCertificateChainPolicy

bcrypt

BCryptDestroyKey BCryptEncrypt BCryptSetProperty BCryptGenerateSymmetricKey BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptDecrypt

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

shell32

SHGetFolderPathW

ws2_32

closesocket recv setsockopt getaddrinfo freeaddrinfo WSASocketW ioctlsocket connect select getsockopt WSAStartup WSACleanup getsockname getpeername WSAGetLastError send

vcruntime140

memcmp __CxxFrameHandler3 memcpy memset memmove __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _seh_filter_exe _get_initial_narrow_environment _initterm _c_exit _initterm_e exit _exit _initialize_narrow_environment __p___argc terminate __p___argv _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_b55325af814bda8ca27dc1c3b756b5d8_akira_cobalt-strike_rusty-stealer_satacom

kernel32

secur32

crypt32

bcrypt

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic