2026-08-20_6b3b83ed07ab6483ae8817a1041371ba_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_6b3b83ed07ab6483ae8817a1041371ba_akira_cobalt-strike_rusty-stealer_satacom
Size 1.1MB
Sample260821-den6sa1fqa
SHA256 c0ae20db9aa22b474c6bdaf60e21a5377ee93f44f089005d2d3e052ad2550188
MD5 6b3b83ed07ab6483ae8817a1041371ba
SHA1 a2ed93bef8042a27b14fd15801d762baf5eb767d
SHA512 4155219ec244bce0172f9ebce0a209b549eca09443653fea27728211cbc3210aa48666301677396f165a99176db89a94462805c2300ec33d67706851a72423e3
SSDEEP 24576:KoyM+U39oXz/qPSCgjlVo6h+cPFvSLtP9L4n:zyqoXz/qPSbjo6h+cStPh
TLSH
T1B8452911BA5A98ACC05AC4B483468A725A3570CB0B35BCFF41D496783F6AEF45F3C729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_6b3b83ed07ab6483ae8817a1041371ba_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-20_6b3b83ed07ab6483ae8817a1041371ba_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.1MB

2026-08-20_6b3b83ed07ab6483ae8817a1041371ba_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH a91ec134912ea3e6bb06c4d73d629d1e
SHA256 c0ae20db9aa22b474c6bdaf60e21a5377ee93f44f089005d2d3e052ad2550188
MD5 6b3b83ed07ab6483ae8817a1041371ba
SHA1 a2ed93bef8042a27b14fd15801d762baf5eb767d
SHA512 4155219ec244bce0172f9ebce0a209b549eca09443653fea27728211cbc3210aa48666301677396f165a99176db89a94462805c2300ec33d67706851a72423e3
SSDEEP 24576:KoyM+U39oXz/qPSCgjlVo6h+cPFvSLtP9L4n:zyqoXz/qPSbjo6h+cStPh
TLSH
T1B8452911BA5A98ACC05AC4B483468A725A3570CB0B35BCFF41D496783F6AEF45F3C729
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

825624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ksp_info.pdb

kernel32

GetLogicalDrives GetDiskFreeSpaceExW GetProcessTimes VirtualQueryEx LocalFree GetLastError GetCurrentProcessId GetSystemInfo GetSystemTimeAsFileTime GetProcessHeap GetTickCount64 HeapFree OpenProcess GetSystemTimes GetDriveTypeW GetVolumeInformationW DeviceIoControl GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute IsProcessorFeaturePresent HeapAlloc CloseHandle GlobalMemoryStatusEx CreateFileW GetProcessIoCounters CreateThread GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar ExitProcess SetUnhandledExceptionFilter GetModuleHandleW GetModuleFileNameW GetTempPathW GetModuleHandleA GetFullPathNameW GetFileType FindClose GetFileInformationByHandle SwitchToThread GetFileInformationByHandleEx CreateDirectoryW CopyFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetCurrentThreadId FindNextFileW InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter FindFirstFileExW FormatMessageW ReadProcessMemory HeapReAlloc lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetFileInformationByHandle

ole32

CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitializeSecurity CoInitializeEx

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantClear SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayDestroy

advapi32

GetLengthSid CopySid OpenProcessToken IsValidSid LookupAccountSidW GetTokenInformation RegOpenKeyExW RegCloseKey RegQueryValueExW

secur32

LsaFreeReturnBuffer LsaEnumerateLogonSessions LsaGetLogonSessionData

shell32

CommandLineToArgvW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion NtQueryInformationProcess NtReadFile RtlNtStatusToDosError NtOpenFile NtWriteFile RtlCaptureContext NtQuerySystemInformation RtlLookupFunctionEntry RtlVirtualUnwind

iphlpapi

FreeMibTable GetIfEntry2 GetAdaptersAddresses GetIfTable2

netapi32

NetApiBufferFree NetUserGetInfo NetUserGetLocalGroups NetUserEnum

pdh

PdhCollectQueryData PdhOpenQueryA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhRemoveCounter PdhCloseQuery

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo GetModuleFileNameExW

vcruntime140

__C_specific_handler _CxxThrowException memmove __current_exception __current_exception_context memcmp memcpy __CxxFrameHandler3 memset

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _set_app_type _seh_filter_exe _configure_narrow_argv _get_initial_narrow_environment _register_onexit_function _initialize_onexit_table terminate _initialize_narrow_environment _register_thread_local_exe_atexit_callback _initterm _c_exit _initterm_e exit _exit __p___argc __p___argv _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_6b3b83ed07ab6483ae8817a1041371ba_akira_cobalt-strike_rusty-stealer_satacom

kernel32

ole32

oleaut32

advapi32

secur32

shell32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

iphlpapi

netapi32

pdh

powrprof

psapi

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic