2026-08-14_988089c12634683eb7f8f3482a67d000_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_988089c12634683eb7f8f3482a67d000_akira_cobalt-strike_rusty-stealer_satacom
Size 9.4MB
Sample260814-eae8ratgkc
SHA256 b58ebe6824b980fa21c700dedd34a38ed5141fd9de9a2e73e17e9ab8baef2096
MD5 988089c12634683eb7f8f3482a67d000
SHA1 9e06fca39d1b06562349d8217f26207d16042ba9
SHA512 22568f71186f69484cf0deae323cd4f37944dea04c211bc7c7bfc8d8c0be7312768b9e4bfa8b884080f2d1528f5c48ad3517ec42a5b9f8fc5c801117d5079237
SSDEEP 49152:WrzwUOVL+ALLJzyiF5NYXXQX9DvxMtdoCh6iTr95tavhAx03rR2IRJdBzeOiXFcs:Rh5LDvxQdchRulcWuFRmbgEkYZ
TLSH
T1BEA6F916A77960D9C17FC07892839F22BD21749907397BF78AC0866A1F60EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_988089c12634683eb7f8f3482a67d000_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-14_988089c12634683eb7f8f3482a67d000_akira_cobalt-strike_rusty-stealer_satacom

.exe 9.4MB

2026-08-14_988089c12634683eb7f8f3482a67d000_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 13edfdf83acd6e290437ea56939b237d
SHA256 b58ebe6824b980fa21c700dedd34a38ed5141fd9de9a2e73e17e9ab8baef2096
MD5 988089c12634683eb7f8f3482a67d000
SHA1 9e06fca39d1b06562349d8217f26207d16042ba9
SHA512 22568f71186f69484cf0deae323cd4f37944dea04c211bc7c7bfc8d8c0be7312768b9e4bfa8b884080f2d1528f5c48ad3517ec42a5b9f8fc5c801117d5079237
SSDEEP 49152:WrzwUOVL+ALLJzyiF5NYXXQX9DvxMtdoCh6iTr95tavhAx03rR2IRJdBzeOiXFcs:Rh5LDvxQdchRulcWuFRmbgEkYZ
TLSH
T1BEA6F916A77960D9C17FC07892839F22BD21749907397BF78AC0866A1F60EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6136768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypter_rs.pdb

shell32

ShellExecuteW DragFinish DragQueryFileW SHCreateItemFromParsingName

kernel32

Sleep SetWaitableTimer GlobalFree LoadLibraryA GlobalAlloc InitializeSListHead GlobalLock GetSystemTimeAsFileTime SetLastError GetModuleHandleA SetUnhandledExceptionFilter GetCurrentThread GetCurrentThreadId GlobalSize GetModuleFileNameW SetThreadErrorMode FreeLibrary GetLastError WideCharToMultiByte CloseHandle GetProcAddress LoadLibraryExW GlobalUnlock WaitForMultipleObjects GetModuleHandleW GetFileAttributesW GetConsoleOutputCP GetConsoleMode WriteConsoleW HeapAlloc FormatMessageW ReleaseMutex CreateMutexA WaitForSingleObjectEx LoadLibraryW SwitchToThread ExitProcess FindClose FindFirstFileExW CopyFileExW MultiByteToWideChar CreateWaitableTimerExW lstrlenW GetCommandLineW GetEnvironmentVariableW CompareStringOrdinal FreeEnvironmentStringsW GetCurrentDirectoryW SetThreadStackGuarantee WaitForSingleObject AddVectoredExceptionHandler WriteFileEx SleepEx GetFullPathNameW CreateDirectoryW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter GetStdHandle GetEnvironmentStringsW GetExitCodeProcess CreateThread CreateProcessW CreateEventW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo RtlVirtualUnwind GetCurrentProcessId RtlLookupFunctionEntry ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

ole32

RegisterDragDrop OleInitialize CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree RevokeDragDrop

user32

ReleaseDC DestroyWindow RegisterTouchWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SetWindowPlacement ChangeDisplaySettingsExW IsProcessDPIAware GetWindowPlacement CreateIconFromResourceEx AdjustWindowRectEx GetWindowLongW SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow CreateIcon RegisterRawInputDevices MapVirtualKeyW GetRawInputData GetKeyboardLayout GetClassNameW GetClassInfoExW GetKeyState GetAsyncKeyState DefWindowProcW GetKeyboardState MapVirtualKeyExW SendMessageW GetSystemMetrics SendInput DestroyIcon SetForegroundWindow ToUnicodeEx RegisterClassExW SystemParametersInfoA EnumDisplayMonitors CreateWindowExW MonitorFromPoint GetDC GetActiveWindow PostMessageW DispatchMessageW ShowCursor ClipCursor GetClipCursor IsIconic GetWindowRect MsgWaitForMultipleObjectsEx GetWindowLongPtrW ReleaseCapture SetCapture RegisterWindowMessageA ValidateRect GetCursorPos MonitorFromWindow SetCursor LoadCursorW ScreenToClient CloseTouchInputHandle GetTouchInputInfo GetMenu TrackMouseEvent MonitorFromRect SetWindowLongPtrW TranslateMessage GetMonitorInfoW CloseClipboard RegisterClipboardFormatW RedrawWindow GetClipboardData IsClipboardFormatAvailable SetClipboardData OpenClipboard EmptyClipboard GetClientRect SetCursorPos InvalidateRgn SetWindowPos ClientToScreen GetForegroundWindow FlashWindowEx PeekMessageW DestroyCursor

gdi32

CreateRectRgn GetDeviceCaps SwapBuffers DescribePixelFormat ChoosePixelFormat SetPixelFormat DeleteObject

opengl32

wglShareLists wglGetCurrentContext wglGetProcAddress wglMakeCurrent wglGetCurrentDC wglCreateContext wglDeleteContext

shlwapi

AssocQueryStringW

advapi32

RevertToSelf ImpersonateAnonymousToken

imm32

ImmGetContext ImmGetCompositionStringW ImmSetCandidateWindow ImmSetCompositionWindow ImmAssociateContextEx ImmReleaseContext

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

ntdll

NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError

vcruntime140

__current_exception __CxxFrameHandler3 memcpy memset memcmp memmove _CxxThrowException __C_specific_handler __current_exception_context

api-ms-win-crt-math-l1-1-0

sinf ceilf powf floorf round ceil roundf floor sin expf pow trunc truncf cos log10 fmod cosf atan2f _hypotf acosf cbrtf __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _set_app_type _seh_filter_exe _get_initial_narrow_environment _initialize_onexit_table _register_thread_local_exe_atexit_callback _initterm _initterm_e _c_exit exit _cexit _exit strerror _crt_atexit __p___argv _register_onexit_function _configure_narrow_argv terminate __p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_988089c12634683eb7f8f3482a67d000_akira_cobalt-strike_rusty-stealer_satacom

shell32

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ole32

user32

gdi32

opengl32

shlwapi

advapi32

imm32

uxtheme

dwmapi

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic