Extracted

• • Target
    2026-08-22_140f883445eb3690c32aeb5a2235ca75_akira_cobalt-strike_rusty-stealer_satacom
  • Size 2.3MB
  • SHA256 04c962164042b67e6512a006d5532ba82bc094018bc43cdcd8d8a2bfe767dbea
  • MD5 140f883445eb3690c32aeb5a2235ca75
  • SHA1 afd24e5b023afef77f39cc959b4e6c4210fe1260
  • SHA512 ed1ae82b042864d8b5f8fd0e154ba8bd914d4ade0a002cd098da3c51d247810d338fabaaadfc4fc9cb695d1aef38a08e4c98f80913a0a4a51cf72ccf44c6e406
  • SSDEEP 24576:DEfZw5++8t3RE+tovd/MQqLEdgmRTE5Of1up+k3UovhrQjEVKx9cBpnCIqiZoBEB:QfZ1JRRid4LmTEbjZSzS1qo9DLcEBH
  • TLSH
    T169B52211BE01A8BECA48C5389146CA765373B8CA1B35B4FB41E056363F5FAF85E3D624
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderratonratloaderpersistencestealer

  • Detects DonutLoader

    loader

  • Detects RatonRAT payload

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables manipulated with Fody

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2