2026-08-12_72e9f98b2c0461afbacb078c6c94000c_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_72e9f98b2c0461afbacb078c6c94000c_akira_cobalt-strike_rusty-stealer_satacom
Size 6.0MB
Sample260812-e53yasvzft
SHA256 06db2c848a43281b51a531fb928ee34ed449f0220f62a7ffe1d2c4bfc6858cc8
MD5 72e9f98b2c0461afbacb078c6c94000c
SHA1 13ac608476f9904ac1f24ae24ba26975bac0f56b
SHA512 ec2c46d05f06c268b31edc374b8a222ec243a092a5d1137aa2f0e1a6da0d3d2a97ce8aafa8423eb7e38b801a3deabe353ef5d86c1158a8fa73abef8c91c8905e
SSDEEP 98304:CDfB9hzso+LlmdgBu7lkn5qzrQn2sbbH+en:kzNd6ozr7GVn
TLSH
T11A567D03F2A291ECC11AC4749315B233EB62BC491B3476EF5BD47A203E66FD05A2DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_72e9f98b2c0461afbacb078c6c94000c_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-12_72e9f98b2c0461afbacb078c6c94000c_akira_cobalt-strike_rusty-stealer_satacom

.exe 6.0MB

2026-08-12_72e9f98b2c0461afbacb078c6c94000c_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 6642eb5f8a920d84a0a3d8d320edfaa1
SHA256 06db2c848a43281b51a531fb928ee34ed449f0220f62a7ffe1d2c4bfc6858cc8
MD5 72e9f98b2c0461afbacb078c6c94000c
SHA1 13ac608476f9904ac1f24ae24ba26975bac0f56b
SHA512 ec2c46d05f06c268b31edc374b8a222ec243a092a5d1137aa2f0e1a6da0d3d2a97ce8aafa8423eb7e38b801a3deabe353ef5d86c1158a8fa73abef8c91c8905e
SSDEEP 98304:CDfB9hzso+LlmdgBu7lkn5qzrQn2sbbH+en:kzNd6ozr7GVn
TLSH
T11A567D03F2A291ECC11AC4749315B233EB62BC491B3476EF5BD47A203E66FD05A2DB59
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3542940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

kernel32

GetModuleHandleA DeleteFileW SetFileInformationByHandle HeapReAlloc FormatMessageW LoadLibraryW GlobalFree HeapAlloc HeapFree GetProcessHeap SetLastError SetHandleInformation GetModuleHandleW CloseHandle GetSystemDirectoryW GetModuleFileNameW LoadLibraryExW LoadLibraryA SetThreadErrorMode GetComputerNameW GetSystemInfo GlobalMemoryStatusEx FreeLibrary DuplicateHandle GetCurrentThread GlobalUnlock ExitProcess SwitchToThread GlobalLock GlobalSize GetFileInformationByHandleEx SetWaitableTimer GlobalAlloc CreateWaitableTimerExW GetTempPathW GetFileInformationByHandle GetQueuedCompletionStatusEx FindClose FindFirstFileExW PostQueuedCompletionStatus ReadFile GetOverlappedResult SetFileTime CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile CancelIoEx Sleep WaitForSingleObject GetCurrentProcess GetFileAttributesW CreateProcessW GetFullPathNameW GetLastError GetCurrentThreadId CreateFileW GetProcAddress GetCurrentProcessId GetSystemTimeAsFileTime GetStdHandle GetConsoleMode GetConsoleOutputCP CreateThread WriteConsoleW WriteFileEx SleepEx ReadFileEx GetSystemTimePreciseAsFileTime GetWindowsDirectoryW InitializeSListHead RtlVirtualUnwind GetCurrentDirectoryW CompareStringOrdinal FreeEnvironmentStringsW QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetEnvironmentStringsW SetUnhandledExceptionFilter

user32

GetClassInfoExW GetClassNameW GetKeyboardState SetCursor LoadCursorW GetAsyncKeyState SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow SetWindowPlacement GetWindowPlacement MonitorFromRect ChangeDisplaySettingsExW FlashWindowEx SetWindowDisplayAffinity SetWindowTextW SetCursorPos GetWindowTextW GetWindowTextLengthW MonitorFromWindow GetWindowRect SetCapture TrackMouseEvent GetClipCursor ClipCursor ShowCursor GetWindowLongW GetKeyState AdjustWindowRectEx IsProcessDPIAware ToUnicodeEx GetCursorPos GetRawInputData ValidateRect CreateIcon IsIconic CreateIconFromResourceEx SendMessageW GetActiveWindow GetClientRect SystemParametersInfoA DestroyIcon IsWindowVisible MonitorFromPoint GetMonitorInfoW EnumDisplayMonitors RemovePropW PostMessageW RegisterWindowMessageA RedrawWindow DestroyWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowLongPtrW InvalidateRgn SetWindowPos RegisterRawInputDevices CreateWindowExW RegisterClassExW ShowWindow DefWindowProcW GetSystemMetrics GetDC ReleaseCapture GetSystemMenu ClientToScreen ReleaseDC GetMenu EnableMenuItem MapVirtualKeyExW SetWindowLongW MsgWaitForMultipleObjectsEx GetKeyboardLayout DestroyCursor CallWindowProcW SetWindowLongPtrW SetPropW GetPropW ScreenToClient CloseClipboard SetClipboardData RegisterTouchWindow GetTouchInputInfo CloseTouchInputHandle GetClipboardData IsClipboardFormatAvailable RegisterClipboardFormatW OpenClipboard EmptyClipboard

gdi32

CreateCompatibleBitmap GetDeviceCaps CreateRectRgn SelectObject BitBlt DeleteObject GetDIBits CreateCompatibleDC DeleteDC ChoosePixelFormat SetPixelFormat DescribePixelFormat SwapBuffers

uiautomationcore

UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider

oleaut32

SysAllocStringLen VariantClear SafeArrayPutElement SafeArrayCreateVector SysStringLen GetErrorInfo SetErrorInfo

ole32

CoCreateFreeThreadedMarshaler OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoUninitialize CoInitializeEx

ntdll

NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile NtReadFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtWriteFile

ws2_32

getsockname WSAGetLastError send setsockopt WSASocketW ioctlsocket closesocket WSAIoctl getpeername bind getsockopt recv WSAStartup WSACleanup getaddrinfo freeaddrinfo shutdown WSASend connect

secur32

FreeCredentialsHandle FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DeleteSecurityContext DecryptMessage EncryptMessage

crypt32

CertGetCertificateChain CertFreeCertificateChain CertDuplicateStore CertFreeCertificateContext CertEnumCertificatesInStore CertDuplicateCertificateContext CertAddCertificateContextToStore CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertDuplicateCertificateChain

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

RevertToSelf SystemFunction036 GetUserNameW ImpersonateAnonymousToken RegGetValueW

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

shell32

DragQueryFileW DragFinish

opengl32

wglCreateContext wglShareLists wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglGetCurrentDC

imm32

ImmReleaseContext ImmAssociateContextEx ImmGetCompositionStringW ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

vcruntime140

memcpy memcmp memmove memset __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

round acosf cbrtf fmod truncf exp2f cos pow floor trunc sin roundf __setusermatherr sinf ceilf floorf expf atan2f _hypotf cosf powf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argc _initialize_narrow_environment _get_initial_narrow_environment strerror _initterm_e _initterm _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xta

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xha

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xea

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xda

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xva

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.txd

Size

512B

Virtual Size

326B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_72e9f98b2c0461afbacb078c6c94000c_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

user32

gdi32

uiautomationcore

oleaut32

ole32

ntdll

ws2_32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

advapi32

shlwapi

bcrypt

shell32

opengl32

imm32

dwmapi

uxtheme

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic