2026-08-26_f80f9f08c4ffb89930eb96eb0643befc_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-26_f80f9f08c4ffb89930eb96eb0643befc_akira_cobalt-strike_rusty-stealer_satacom
Size 10.0MB
Sample260827-bzwp9acq21
SHA256 7b8dca05c1d46d37c4aee5e7ca656137e1a218330787e53c657e4bb2d9c35fb3
MD5 f80f9f08c4ffb89930eb96eb0643befc
SHA1 cd11372d5077654be73707e91bd262d4776f8b2a
SHA512 dcb5e5474b94858035dfe648e066c7bb8bdd29131152c169e5c833e04691c1145f623ae6d50d28aee7d4c259497422af437afb8a00ed60bdc2246390b494f220
SSDEEP 98304:QMd7vZ4tEqPYJOtDkPwvDw05IFCddnlhVIm:dvZ4tEqgJORLvD
TLSH
T169B6A526667DA4DDC17BC0B882839F21692270DA0B392FF345D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-26_f80f9f08c4ffb89930eb96eb0643befc_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-08-26_f80f9f08c4ffb89930eb96eb0643befc_akira_cobalt-strike_rusty-stealer_satacom

.exe 10.0MB

2026-08-26_f80f9f08c4ffb89930eb96eb0643befc_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH a4bd8a9e607c739c313f41914463c2b3
SHA256 7b8dca05c1d46d37c4aee5e7ca656137e1a218330787e53c657e4bb2d9c35fb3
MD5 f80f9f08c4ffb89930eb96eb0643befc
SHA1 cd11372d5077654be73707e91bd262d4776f8b2a
SHA512 dcb5e5474b94858035dfe648e066c7bb8bdd29131152c169e5c833e04691c1145f623ae6d50d28aee7d4c259497422af437afb8a00ed60bdc2246390b494f220
SSDEEP 98304:QMd7vZ4tEqPYJOtDkPwvDw05IFCddnlhVIm:dvZ4tEqgJORLvD
TLSH
T169B6A526667DA4DDC17BC0B882839F21692270DA0B392FF345D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7664672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-706e50924261d44d.pdb

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

kernel32

AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW HeapReAlloc HeapFree GetProcessHeap LoadLibraryA GetCurrentProcess GetSystemTimeAsFileTime GetModuleHandleA CopyFileExW CreateDirectoryW CreateSymbolicLinkW DeviceIoControl GetFileInformationByHandleEx GetLastError SwitchToThread CreateFileW CreateEventW GetOverlappedResult DeleteFileW GetFinalPathNameByHandleW FindFirstFileExW SetEnvironmentVariableW GetProcAddress InitializeSListHead GetConsoleMode WideCharToMultiByte GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess SetCurrentDirectoryW ReadFileEx SleepEx ReadFile SetFileInformationByHandle CancelIo GetFileInformationByHandle HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetCurrentThreadId GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetNativeSystemInfo SetFilePointerEx ReleaseMutex WaitForSingleObject WaitForMultipleObjects GetFileSizeEx GetFileAttributesW FindNextFileW FindFirstFileW FindClose CloseHandle WaitForSingleObjectEx GetFullPathNameW lstrlenW DuplicateHandle CreateMutexA GetCurrentProcessId SetUnhandledExceptionFilter

ole32

CoCreateInstance CoInitialize CoInitializeEx

oleaut32

SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW RegEnumKeyExW RegOpenKeyExA

ntdll

NtWriteFile NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError NtReadFile

vcruntime140

__CxxFrameHandler3 memset memcmp memmove __current_exception_context __current_exception __C_specific_handler _CxxThrowException memcpy wcschr

api-ms-win-crt-string-l1-1-0

wcslen _wcsdup

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fgetws fclose _fileno _get_osfhandle _set_fmode _wfopen_s __p__commode __stdio_common_vswscanf

api-ms-win-crt-math-l1-1-0

fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _cexit __p___argv __p___argc _exit _crt_atexit exit _seh_filter_exe _set_app_type _initterm_e _initterm terminate _configure_narrow_argv _register_thread_local_exe_atexit_callback _initialize_narrow_environment _c_exit _get_initial_narrow_environment

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-26_f80f9f08c4ffb89930eb96eb0643befc_akira_cobalt-strike_rusty-stealer_satacom

shell32

combase

kernel32

ole32

oleaut32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic