2026-08-07_e8c3de588027793e4d785ec725d67168_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_e8c3de588027793e4d785ec725d67168_akira_cobalt-strike_rusty-stealer_satacom
Size 354KB
Sample260808-as6ffaag93
SHA256 34b20c2ae5c0adc99380ca0f5e1d9e71620811a5e51f96c84a3ff3fa774d4eb8
MD5 e8c3de588027793e4d785ec725d67168
SHA1 ad79c8c9b8d051d7608563848b5d918224f526f7
SHA512 51437ebcc4c09268c6c2c4206bece0014a190f67e2445775ceb8a40564353ac90b90f483c8ac2cbf8cfe03cd667f877b47d22d938421a33c469ef14790f8618a
SSDEEP 6144:azXuAShFCeb6DVrc0DZBS9hgzYkmVBfWl:aCD6DZblzaVkl
TLSH
T1E7745B2BF68445E8D9E7C0BA8713CB73B532B4CC0F6264FB15E842541E19AE97B39718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_e8c3de588027793e4d785ec725d67168_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-07_e8c3de588027793e4d785ec725d67168_akira_cobalt-strike_rusty-stealer_satacom

.exe 354KB

2026-08-07_e8c3de588027793e4d785ec725d67168_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 08b050fc666dc081bbb4d7efb520b68a
SHA256 34b20c2ae5c0adc99380ca0f5e1d9e71620811a5e51f96c84a3ff3fa774d4eb8
MD5 e8c3de588027793e4d785ec725d67168
SHA1 ad79c8c9b8d051d7608563848b5d918224f526f7
SHA512 51437ebcc4c09268c6c2c4206bece0014a190f67e2445775ceb8a40564353ac90b90f483c8ac2cbf8cfe03cd667f877b47d22d938421a33c469ef14790f8618a
SSDEEP 6144:azXuAShFCeb6DVrc0DZBS9hgzYkmVBfWl:aCD6DZblzaVkl
TLSH
T1E7745B2BF68445E8D9E7C0BA8713CB73B532B4CC0F6264FB15E842541E19AE97B39718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

210304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

LoadLibraryA GetModuleHandleW GetSystemTimeAsFileTime SetHandleInformation SetLastError GetTickCount64 HeapReAlloc GetModuleFileNameW HeapFree GetProcessHeap CloseHandle GetLastError GetModuleHandleA GetProcAddress HeapAlloc ExitProcess SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFinalPathNameByHandleW CreateFileW GetFullPathNameW GetTempPathW QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte ReleaseMutex CreateMutexA lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId CreateThread GetCurrentProcessId SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

secur32

AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW FreeContextBuffer EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle DeleteSecurityContext DecryptMessage

crypt32

CertFreeCertificateChain CertGetCertificateChain CertDuplicateStore CertFreeCertificateContext CertOpenStore CertCloseStore CertEnumCertificatesInStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertVerifyCertificateChainPolicy

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

getpeername getsockname WSACleanup WSAStartup getsockopt select connect ioctlsocket WSASocketW freeaddrinfo getaddrinfo recv WSAGetLastError send closesocket setsockopt

vcruntime140

memcpy __current_exception_context __current_exception __C_specific_handler memset memmove memcmp __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_c_exit _crt_atexit __p___argv terminate _register_thread_local_exe_atexit_callback _initialize_onexit_table __p___argc _seh_filter_exe _exit _register_onexit_function exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _cexit _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_e8c3de588027793e4d785ec725d67168_akira_cobalt-strike_rusty-stealer_satacom

kernel32

secur32

crypt32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic