2026-08-07_61511d828b4798bed4406e7f4d82c4d4_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_61511d828b4798bed4406e7f4d82c4d4_akira_cobalt-strike_rusty-stealer_satacom
Size 333KB
Sample260808-bnemlaxcld
SHA256 0b4b9ff7810a0a7e27179eac849c467cd1d5908d7474264be146cab547c80e29
MD5 61511d828b4798bed4406e7f4d82c4d4
SHA1 813c7437e8788415b84cb08ddaf0a64fb1ed81c3
SHA512 f0f79c8b2f126c56a4adb16f3388ac0374b65762419d499d95e284377c52dee78476260b430a84b13cdd9dd7fcbc4261224d3e76b94973cd160421706c76428e
SSDEEP 6144:7AMfpfJ9AO+Y9OU8W1c9ozvAsLm3PoMk4aNmr9BXCfZPkU:DpfbAO+6qVVAkHaV
TLSH
T17B745B03F66698FDE85AC0758326AA73BE727889476279EF029846343E55FD07B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_61511d828b4798bed4406e7f4d82c4d4_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-07_61511d828b4798bed4406e7f4d82c4d4_akira_cobalt-strike_rusty-stealer_satacom

.exe 333KB

2026-08-07_61511d828b4798bed4406e7f4d82c4d4_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH e42348e62a2ddb45e9ed14fb00439c03
SHA256 0b4b9ff7810a0a7e27179eac849c467cd1d5908d7474264be146cab547c80e29
MD5 61511d828b4798bed4406e7f4d82c4d4
SHA1 813c7437e8788415b84cb08ddaf0a64fb1ed81c3
SHA512 f0f79c8b2f126c56a4adb16f3388ac0374b65762419d499d95e284377c52dee78476260b430a84b13cdd9dd7fcbc4261224d3e76b94973cd160421706c76428e
SSDEEP 6144:7AMfpfJ9AO+Y9OU8W1c9ozvAsLm3PoMk4aNmr9BXCfZPkU:DpfbAO+6qVVAkHaV
TLSH
T17B745B03F66698FDE85AC0758326AA73BE727889476279EF029846343E55FD07B3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

257408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

runtime_broker.pdb

kernel32

GetModuleFileNameW GetSystemTimeAsFileTime GetLastError HeapFree HeapReAlloc GetModuleHandleA CloseHandle SetLastError GetTickCount64 GetProcessHeap GetProcAddress FreeLibrary HeapAlloc LoadLibraryA SetHandleInformation LoadLibraryW GetModuleHandleW InitializeSListHead SetUnhandledExceptionFilter WideCharToMultiByte Sleep SetWaitableTimer CreateWaitableTimerExW GetFullPathNameW GetFinalPathNameByHandleW GetTempPathW ExitProcess CreateThread QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind ReleaseMutex lstrlenW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW GetCurrentThreadId SwitchToThread GetFileSizeEx GetCurrentProcessId CreateMutexA WriteFile CreateDirectoryW GetVolumeInformationA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW DeleteFileW CreateProcessW CreateFileW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW

secur32

DecryptMessage EncryptMessage AcquireCredentialsHandleA FreeContextBuffer QueryContextAttributesW DeleteSecurityContext InitializeSecurityContextW AcceptSecurityContext FreeCredentialsHandle

crypt32

CertCloseStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateCertificateChain CertFreeCertificateChain CertOpenStore CertFreeCertificateContext CertAddCertificateContextToStore CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore

bcrypt

BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyKey BCryptCreateHash BCryptEncrypt BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGetProperty BCryptSetProperty BCryptOpenAlgorithmProvider

bcryptprimitives

ProcessPrng

advapi32

AllocateAndInitializeSid FreeSid CheckTokenMembership RegQueryValueExW RegCloseKey OpenProcessToken RegOpenKeyExW

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

SHGetFolderPathW

ws2_32

WSASocketW connect getaddrinfo setsockopt recv closesocket WSAGetLastError select getsockopt WSAStartup WSACleanup getsockname getpeername ioctlsocket freeaddrinfo send

vcruntime140

memcmp memcpy __current_exception __C_specific_handler memset __current_exception_context __CxxFrameHandler3 memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argv _exit exit _initterm_e _cexit _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argc _set_app_type _seh_filter_exe _c_exit terminate _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function _initialize_onexit_table _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_61511d828b4798bed4406e7f4d82c4d4_akira_cobalt-strike_rusty-stealer_satacom

kernel32

secur32

crypt32

bcrypt

bcryptprimitives

advapi32

ntdll

api-ms-win-core-synch-l1-2-0

shell32

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic