2026-08-13_54ad70f1500616de981b8bb283460c79_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_54ad70f1500616de981b8bb283460c79_akira_cobalt-strike_rusty-stealer_satacom
Size 6.0MB
Sample260813-flexssbm7s
SHA256 077526b24f77abad79dea8f50d928964361e1f7728fdf5881fdc3ceb0c36bcd5
MD5 54ad70f1500616de981b8bb283460c79
SHA1 bdf27d44e3a462d51ea6fb1884784085970f8f10
SHA512 18d1718c2282ee469be68f609c07ad908aa0bf215a98b9dcb04f774aa00ef81a14ec8ccdfd3156ee8c530072ea5f513be5a763a53058aef3a5fa585fe0205e9f
SSDEEP 98304:raOqz3+mo3Wl1j+TSmr6VqQqrE5vbIH+:c+WvgQqqy
TLSH
T120567D03F36291ECC11AC4749355A233EB62BC491B3576EF5BD47A203EA6FD05A2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_54ad70f1500616de981b8bb283460c79_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-13_54ad70f1500616de981b8bb283460c79_akira_cobalt-strike_rusty-stealer_satacom

.exe 6.0MB

2026-08-13_54ad70f1500616de981b8bb283460c79_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 2040fd927b35562fcfdf079a2c7f3fef
SHA256 077526b24f77abad79dea8f50d928964361e1f7728fdf5881fdc3ceb0c36bcd5
MD5 54ad70f1500616de981b8bb283460c79
SHA1 bdf27d44e3a462d51ea6fb1884784085970f8f10
SHA512 18d1718c2282ee469be68f609c07ad908aa0bf215a98b9dcb04f774aa00ef81a14ec8ccdfd3156ee8c530072ea5f513be5a763a53058aef3a5fa585fe0205e9f
SSDEEP 98304:raOqz3+mo3Wl1j+TSmr6VqQqrE5vbIH+:c+WvgQqqy
TLSH
T120567D03F36291ECC11AC4749355A233EB62BC491B3576EF5BD47A203EA6FD05A2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3530140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

kernel32

HeapAlloc DeleteFileW SetFileInformationByHandle HeapReAlloc HeapFree DuplicateHandle GetModuleHandleA LoadLibraryW GlobalFree GetSystemTimePreciseAsFileTime SetHandleInformation FormatMessageW GetProcAddress SetLastError GetLastError FreeLibrary LoadLibraryA GetProcessHeap GetComputerNameW GetSystemTimeAsFileTime GlobalMemoryStatusEx GetCurrentProcessId GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle WaitForSingleObject GetCurrentThread GlobalUnlock GetCurrentThreadId SwitchToThread GlobalLock GlobalSize SetWaitableTimer CreateWaitableTimerExW GlobalAlloc GetTempPathW FindClose SetThreadErrorMode GetQueuedCompletionStatusEx FindFirstFileExW SetFileTime PostQueuedCompletionStatus ReadFile GetOverlappedResult GetFullPathNameW CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile CancelIoEx Sleep LoadLibraryExW GetModuleFileNameW CreateThread CloseHandle GetModuleHandleW GetCurrentProcess CreateFileW ExitProcess GetFileAttributesW CreateProcessW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW WriteFileEx SleepEx ReadFileEx GetWindowsDirectoryW GetSystemInfo InitializeSListHead RtlVirtualUnwind GetCurrentDirectoryW CompareStringOrdinal FreeEnvironmentStringsW QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW GetEnvironmentStringsW SetUnhandledExceptionFilter

user32

GetClassNameW ShowWindow SetCursor LoadCursorW GetClassInfoExW GetMenu SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow SetWindowPlacement GetWindowPlacement GetSystemMenu ChangeDisplaySettingsExW FlashWindowEx SetWindowDisplayAffinity SetWindowTextW SetCursorPos EnableMenuItem GetWindowTextLengthW MonitorFromWindow GetWindowRect CreateIcon SetWindowLongW ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx ToUnicodeEx AdjustWindowRectEx GetWindowLongW ShowCursor ClipCursor GetClipCursor TrackMouseEvent SetCapture MonitorFromRect IsIconic CreateIconFromResourceEx SendMessageW GetActiveWindow GetClientRect SystemParametersInfoA DestroyCursor IsWindowVisible MonitorFromPoint GetMonitorInfoW EnumDisplayMonitors RemovePropW PostMessageW RegisterWindowMessageA RedrawWindow DestroyWindow DispatchMessageW TranslateMessage PeekMessageW GetWindowLongPtrW InvalidateRgn SetWindowPos RegisterRawInputDevices CreateWindowExW RegisterClassExW DestroyIcon DefWindowProcW GetCursorPos ReleaseCapture GetKeyboardState GetAsyncKeyState ClientToScreen ScreenToClient ReleaseDC GetKeyboardLayout MapVirtualKeyExW GetSystemMetrics IsProcessDPIAware GetKeyState GetWindowTextW CallWindowProcW SetWindowLongPtrW SetPropW GetPropW GetDC CloseClipboard SetClipboardData RegisterTouchWindow GetTouchInputInfo CloseTouchInputHandle GetClipboardData IsClipboardFormatAvailable RegisterClipboardFormatW OpenClipboard EmptyClipboard

gdi32

CreateCompatibleDC BitBlt GetDIBits CreateRectRgn SelectObject DeleteDC DeleteObject GetDeviceCaps CreateCompatibleBitmap ChoosePixelFormat SetPixelFormat DescribePixelFormat SwapBuffers

ntdll

NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile

uiautomationcore

UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaLookupId

oleaut32

SetErrorInfo SysAllocStringLen GetErrorInfo VariantClear SysStringLen SafeArrayPutElement SafeArrayCreateVector

ole32

CoCreateFreeThreadedMarshaler OleInitialize RevokeDragDrop CoInitializeEx CoCreateInstance CoUninitialize RegisterDragDrop

ws2_32

WSASend shutdown freeaddrinfo getaddrinfo WSACleanup WSAStartup getsockopt bind WSAIoctl ioctlsocket WSASocketW setsockopt getsockname connect recv closesocket WSAGetLastError send getpeername

secur32

FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA DecryptMessage EncryptMessage FreeContextBuffer AcceptSecurityContext InitializeSecurityContextW

crypt32

CertFreeCertificateChain CertDuplicateCertificateChain CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateContext CertAddCertificateContextToStore CertDuplicateCertificateContext CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertGetCertificateChain

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

RevertToSelf SystemFunction036 GetUserNameW ImpersonateAnonymousToken RegGetValueW

shlwapi

AssocQueryStringW

bcrypt

BCryptGenRandom

shell32

DragFinish DragQueryFileW

opengl32

wglCreateContext wglShareLists wglDeleteContext wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglGetCurrentDC

imm32

ImmSetCompositionWindow ImmAssociateContextEx ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmGetCompositionStringW

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

uxtheme

SetWindowTheme

vcruntime140

memcpy memcmp memmove memset __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

round acosf cbrtf fmod truncf exp2f cos pow floor trunc sin roundf __setusermatherr sinf ceilf floorf expf atan2f _hypotf cosf powf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

__p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _exit exit _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argc _initialize_narrow_environment _get_initial_narrow_environment strerror _initterm_e _initterm _seh_filter_exe _set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xta

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xha

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xea

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xda

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xva

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.txd

Size

512B

Virtual Size

326B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_54ad70f1500616de981b8bb283460c79_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

user32

gdi32

ntdll

uiautomationcore

oleaut32

ole32

ws2_32

secur32

crypt32

api-ms-win-core-synch-l1-2-0

advapi32

shlwapi

bcrypt

shell32

opengl32

imm32

dwmapi

uxtheme

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic