2026-08-15_e72b139c5fc11d2c3af6a594c98d79b8_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_e72b139c5fc11d2c3af6a594c98d79b8_akira_cobalt-strike_rusty-stealer_satacom
Size 308KB
Sample260815-ftp3qszale
SHA256 b2b760205f5183535ee9fe738fbae222dd3e705c2b1e48de883226a1ad5d2996
MD5 e72b139c5fc11d2c3af6a594c98d79b8
SHA1 868ee3abe0c3e29a41b568c767d398d2f27e6016
SHA512 a4d52fa2506b9623675f7696f2476959f8ce01f1ae83f8d6e3cfcfe750be5021426a7a08600008d4fac700f75758084491e971849993237967589a9230c9f4f1
SSDEEP 6144:FtwVXWQe7Qy8C5K2G/rimvXGq6ymFOP1jt5WWz1n:FOXWL2KGtGhYvpp
TLSH
T1A5644C12FA5698F8E457C074834685B3AD7678C60B22B9FF169425383E7AEE12F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-15_e72b139c5fc11d2c3af6a594c98d79b8_akira_cobalt-strike_rusty-stealer_satacom

.exe 308KB

2026-08-15_e72b139c5fc11d2c3af6a594c98d79b8_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH eb1a0b57e760696a4646bcfb5084fce1
SHA256 b2b760205f5183535ee9fe738fbae222dd3e705c2b1e48de883226a1ad5d2996
MD5 e72b139c5fc11d2c3af6a594c98d79b8
SHA1 868ee3abe0c3e29a41b568c767d398d2f27e6016
SHA512 a4d52fa2506b9623675f7696f2476959f8ce01f1ae83f8d6e3cfcfe750be5021426a7a08600008d4fac700f75758084491e971849993237967589a9230c9f4f1
SSDEEP 6144:FtwVXWQe7Qy8C5K2G/rimvXGq6ymFOP1jt5WWz1n:FOXWL2KGtGhYvpp
TLSH
T1A5644C12FA5698F8E457C074834685B3AD7678C60B22B9FF169425383E7AEE12F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

57:ce:ce:7f:c1:d2:16:ef:15:2b:66:c6:c6:5f:fa:f0:f6:5d:8a:5b:0f:64:25:12:4b:86:e3:56:23:7c:1c:a0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Chains

Aug 9, 2026

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=ALI ALSHARIFI,O=ALI ALSHARIFI,L=Kuwait City,C=KW

Serial Number

18:e3:9e:88:96:d2:39:fa:85:00:f1:72:0b:63:eb:ad

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 18, 2026 - Jun 18, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

221008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RedBooster_dlss.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

SleepEx WriteFileEx GetModuleHandleW FormatMessageW GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx AddVectoredExceptionHandler CancelIo ReadFile GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentVariableW GetModuleFileNameW DuplicateHandle CreateThread QueryPerformanceCounter GetFinalPathNameByHandleW CopyFileExW FindNextFileW FindClose SetFileInformationByHandle HeapAlloc DeleteFileW GetExitCodeProcess GetLastError GetOverlappedResult WaitForMultipleObjects CloseHandle InitializeSListHead WaitForSingleObject SetUnhandledExceptionFilter HeapFree WriteConsoleW MultiByteToWideChar GetProcessHeap GetSystemTimeAsFileTime GetConsoleOutputCP GetConsoleMode GetStdHandle RtlVirtualUnwind WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx GetCommandLineW ReadFileEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW SetLastError GetCurrentThreadId HeapReAlloc GetCurrentThread GetFileAttributesW SetThreadStackGuarantee CreateEventW

ntdll

NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile

vcruntime140

__current_exception memcpy __current_exception_context memcmp __CxxFrameHandler3 memmove memset __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argv terminate _crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _cexit _initialize_narrow_environment __p___argc _set_app_type _exit exit _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_e72b139c5fc11d2c3af6a594c98d79b8_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic