2026-08-07_69b63a5db34a54c7b6460d1ab3d527a2_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_69b63a5db34a54c7b6460d1ab3d527a2_akira_cobalt-strike_rusty-stealer_satacom
Size 360KB
Sample260808-blxemaba43
SHA256 ab72a08d4f8e842c2ed30afb00fe8a7e11b442178f84bdd4e4a6b7fb0ea7ae6b
MD5 69b63a5db34a54c7b6460d1ab3d527a2
SHA1 fd1b401dc8311f243753ec663bf8901a3b280552
SHA512 3497a531cc6d423447e66f47b8aabfaf661b836ae9b8dff5be0e819c9fd3cae179c6a090a46d7545847b366212fddc62d7d5a5247f97ca83b311b989bb326fd7
SSDEEP 6144:OSZDS3YOBCXbDC4cehHJSrXlTvvTjbbeg9wDaWm:OmSIOBg+4zhfzm
TLSH
T18F746C2BF68414F8D5E7C0BA8316DB73B63774CC0F6264FB16A841142E19BA87B39758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_69b63a5db34a54c7b6460d1ab3d527a2_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-07_69b63a5db34a54c7b6460d1ab3d527a2_akira_cobalt-strike_rusty-stealer_satacom

.exe 360KB

2026-08-07_69b63a5db34a54c7b6460d1ab3d527a2_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH ab79066d97254e8cbfb7cb51cdc81bb0
SHA256 ab72a08d4f8e842c2ed30afb00fe8a7e11b442178f84bdd4e4a6b7fb0ea7ae6b
MD5 69b63a5db34a54c7b6460d1ab3d527a2
SHA1 fd1b401dc8311f243753ec663bf8901a3b280552
SHA512 3497a531cc6d423447e66f47b8aabfaf661b836ae9b8dff5be0e819c9fd3cae179c6a090a46d7545847b366212fddc62d7d5a5247f97ca83b311b989bb326fd7
SSDEEP 6144:OSZDS3YOBCXbDC4cehHJSrXlTvvTjbbeg9wDaWm:OmSIOBg+4zhfzm
TLSH
T18F746C2BF68414F8D5E7C0BA8316DB73B63774CC0F6264FB16A841142E19BA87B39758
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

SetHandleInformation GetModuleFileNameW HeapReAlloc LoadLibraryA HeapAlloc SetLastError GetSystemTimeAsFileTime HeapFree CloseHandle GetModuleHandleA GetProcAddress GetProcessHeap FreeLibrary GetModuleHandleW GetLastError ReleaseMutex SetUnhandledExceptionFilter InitializeSListHead Sleep SetWaitableTimer CreateWaitableTimerExW GetFinalPathNameByHandleW GetFullPathNameW GetTempPathW ExitProcess QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte CreateMutexA GetCurrentProcessId lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId CreateThread GetFileSizeEx WriteFile CreateDirectoryW GetFileAttributesW RemoveDirectoryW FindClose FindNextFileW FindFirstFileW DeleteFileW CreateFileW SwitchToThread GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptGenRandom BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptGetProperty BCryptHashData BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

advapi32

SystemFunction036

secur32

QueryContextAttributesW FreeContextBuffer EncryptMessage AcquireCredentialsHandleA FreeCredentialsHandle InitializeSecurityContextW AcceptSecurityContext DeleteSecurityContext DecryptMessage

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateStore CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

closesocket getpeername getsockname WSACleanup WSAStartup getsockopt setsockopt select connect ioctlsocket WSASocketW freeaddrinfo getaddrinfo recv send WSAGetLastError

vcruntime140

memcpy __current_exception_context __current_exception __C_specific_handler memset memmove memcmp __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _seh_filter_exe _c_exit _cexit __p___argv _initialize_onexit_table terminate __p___argc _crt_atexit _register_onexit_function _initterm _initterm_e exit _register_thread_local_exe_atexit_callback _exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_69b63a5db34a54c7b6460d1ab3d527a2_akira_cobalt-strike_rusty-stealer_satacom

kernel32

bcrypt

advapi32

secur32

crypt32

bcryptprimitives

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic