2026-08-13_43c49bf1fb27dc642ee33bc2b5434a4d_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_43c49bf1fb27dc642ee33bc2b5434a4d_akira_cobalt-strike_rusty-stealer_satacom
Size 920KB
Sample260813-lt1gcsv1cv
SHA256 f9e56bf456d18e74d2d728b6b58542cf41beee24d3f7401a85c535fad1fef175
MD5 43c49bf1fb27dc642ee33bc2b5434a4d
SHA1 6161c9d0a16de4375a34ad65265676f3f17c4c0d
SHA512 d364c276b195d0460f0e36fd73efb3f00971d7599e41c4cd523c752d3f8c306ad292166c598edee2c42e73abdadb667a2d165062d0eafaaefdc93d2dc5452660
SSDEEP 24576:9SjJSgdPWhEp9ZLYrm7LE7Jx+IpgFvb2+7Z:4VdPMKA+IpgFvS+7Z
TLSH
T1DA151725BB5954E9C06BC438835A8A626A3034CF0B35B9FB04C985793F69BF55F3D328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_43c49bf1fb27dc642ee33bc2b5434a4d_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-13_43c49bf1fb27dc642ee33bc2b5434a4d_akira_cobalt-strike_rusty-stealer_satacom

.exe 920KB

2026-08-13_43c49bf1fb27dc642ee33bc2b5434a4d_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 77cc193766162c6e2078d39b259ea71b
SHA256 f9e56bf456d18e74d2d728b6b58542cf41beee24d3f7401a85c535fad1fef175
MD5 43c49bf1fb27dc642ee33bc2b5434a4d
SHA1 6161c9d0a16de4375a34ad65265676f3f17c4c0d
SHA512 d364c276b195d0460f0e36fd73efb3f00971d7599e41c4cd523c752d3f8c306ad292166c598edee2c42e73abdadb667a2d165062d0eafaaefdc93d2dc5452660
SSDEEP 24576:9SjJSgdPWhEp9ZLYrm7LE7Jx+IpgFvb2+7Z:4VdPMKA+IpgFvS+7Z
TLSH
T1DA151725BB5954E9C06BC438835A8A626A3034CF0B35B9FB04C985793F69BF55F3D328
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

678400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rust_out.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

GetSystemTimeAsFileTime SetUnhandledExceptionFilter InitializeSListHead CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileType GetModuleHandleW FormatMessageW WaitForMultipleObjects GetModuleHandleA

ntdll

NtWriteFile NtOpenFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcpy __current_exception __C_specific_handler __current_exception_context memset memmove memcmp _CxxThrowException

api-ms-win-crt-math-l1-1-0

__setusermatherr floor fmod

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_onexit_function __p___argc __p___argv _initialize_onexit_table _c_exit _register_thread_local_exe_atexit_callback terminate _configure_narrow_argv _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_43c49bf1fb27dc642ee33bc2b5434a4d_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic