2026-08-19_f9780a5090157c36db7f1444e789c2e4_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_f9780a5090157c36db7f1444e789c2e4_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom
Size 4.9MB
Sample260819-eamb3awcne
SHA256 8fc148e5bed9a814f37d5f7114e6ec4213752482b5188eb6ca4add57a4334ff8
MD5 f9780a5090157c36db7f1444e789c2e4
SHA1 a6a619b2bc4df7538e7b4ca12ecd63bde90065ea
SHA512 12d849c5dbe95c17e4605c2a81b38a92ec547f62e169eaff07df5030f01426e4c785ae6e91f7000a72e13dd7fdc15c9cf2ad865a631bb850c34ad8add12743a9
SSDEEP 49152:6tLlv/0NtJhweByWkGjYDQ4iIUee/gAHM8FffHAqIepMj53xB6YldsbEsZc6UfTD:/Tur54f7U
TLSH
T1E136D72576BC50EDC277C0B882838F65692270DA0B366BF740D4827A2F25EF96D3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_f9780a5090157c36db7f1444e789c2e4_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

File Explorer

2026-08-19_f9780a5090157c36db7f1444e789c2e4_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

.exe 4.9MB

2026-08-19_f9780a5090157c36db7f1444e789c2e4_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

IMPHASH e50ca9f01d44f66f8270b02c19bb061c
SHA256 8fc148e5bed9a814f37d5f7114e6ec4213752482b5188eb6ca4add57a4334ff8
MD5 f9780a5090157c36db7f1444e789c2e4
SHA1 a6a619b2bc4df7538e7b4ca12ecd63bde90065ea
SHA512 12d849c5dbe95c17e4605c2a81b38a92ec547f62e169eaff07df5030f01426e4c785ae6e91f7000a72e13dd7fdc15c9cf2ad865a631bb850c34ad8add12743a9
SSDEEP 49152:6tLlv/0NtJhweByWkGjYDQ4iIUee/gAHM8FffHAqIepMj53xB6YldsbEsZc6UfTD:/Tur54f7U
TLSH
T1E136D72576BC50EDC277C0B882838F65692270DA0B366BF740D4827A2F25EF96D3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3918672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

application_evaluation_contract-a79553e5f7d82d17.pdb

bcryptprimitives

ProcessPrng

kernel32

MoveFileExW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle CloseHandle InitializeSListHead GetSystemTimeAsFileTime GetTempPathW GetModuleHandleA WaitForMultipleObjects FormatMessageW GetModuleHandleW GetFileType GetFileAttributesW SetUnhandledExceptionFilter GetConsoleOutputCP GetConsoleMode CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtWriteFile

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memmove memset memcmp memcpy __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

floor fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table __p___argc _crt_atexit __p___argv _cexit _initterm_e _c_exit _exit _seh_filter_exe _set_app_type _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_f9780a5090157c36db7f1444e789c2e4_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic