2026-09-05_4dfc0eaeb354d98502996f71a180b2aa_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-05_4dfc0eaeb354d98502996f71a180b2aa_akira_cobalt-strike_rusty-stealer_satacom
Size 3.1MB
Sample260907-3erpcawsd1
SHA256 3a2e1c1a659193582da77b1776e9109c9a4668083fd3d0e05fb7f9aab52e9942
MD5 4dfc0eaeb354d98502996f71a180b2aa
SHA1 a0d1f54c783a0087b28a2985f772c59e11431de1
SHA512 d4c7639f4aee5a78f1d824a9384f5048b44712e6bae3000849323f1ce286c712817a962c99699432c8c654160702fb8315b096904e4bb14b7d840e7cb5db1b01
SSDEEP 49152:lRKGnYF8hNatOJBmuZNPP9bVrfKJeq0J1U0:l04hNzB7xbU0
TLSH
T125E5AD03F346C6EDD10AD0B48755A223DA63F4454736A2FF7BC81E20AE56AA08F1D75E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-05_4dfc0eaeb354d98502996f71a180b2aa_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-09-05_4dfc0eaeb354d98502996f71a180b2aa_akira_cobalt-strike_rusty-stealer_satacom

.exe 3.1MB

2026-09-05_4dfc0eaeb354d98502996f71a180b2aa_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 23e918cdd5e6a055e8ed32db31db7470
SHA256 3a2e1c1a659193582da77b1776e9109c9a4668083fd3d0e05fb7f9aab52e9942
MD5 4dfc0eaeb354d98502996f71a180b2aa
SHA1 a0d1f54c783a0087b28a2985f772c59e11431de1
SHA512 d4c7639f4aee5a78f1d824a9384f5048b44712e6bae3000849323f1ce286c712817a962c99699432c8c654160702fb8315b096904e4bb14b7d840e7cb5db1b01
SSDEEP 49152:lRKGnYF8hNatOJBmuZNPP9bVrfKJeq0J1U0:l04hNzB7xbU0
TLSH
T125E5AD03F346C6EDD10AD0B48755A223DA63F4454736A2FF7BC81E20AE56AA08F1D75E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1243616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell.pdb

kernel32

GetModuleFileNameW LoadLibraryExW SetThreadErrorMode FreeLibrary GetProcAddress FormatMessageW SetLastError HeapAlloc DuplicateHandle CompareStringOrdinal HeapFree lstrlenW GetModuleHandleA Sleep GlobalFree MultiByteToWideChar WideCharToMultiByte GetProcessHeap CloseHandle LoadLibraryExA GetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter SleepEx ReadFileEx GetEnvironmentVariableW WriteConsoleW WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle GetCurrentDirectoryW RtlVirtualUnwind ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext LoadLibraryA LoadLibraryW GlobalAlloc GlobalSize GetCurrentThreadId GlobalUnlock GlobalLock HeapReAlloc GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetLocalTime GetCommandLineW GetProcessId FindClose FindNextFileW GetSystemTimePreciseAsFileTime FindFirstFileExW GetModuleHandleW SwitchToThread QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess WriteFileEx GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW OutputDebugStringW OutputDebugStringA SetWaitableTimer CreateWaitableTimerExW DeleteFileW GetTempPathW

user32

GetClientRect SetWindowPos SetWindowDisplayAffinity GetPropW IsProcessDPIAware GetMenu CallNextHookEx GetWindowLongPtrW GetWindowPlacement GetCursorPos LoadCursorW SetCursor SetPropW PeekMessageW SetTimer KillTimer CreateIcon GetWindowTextLengthW GetWindowTextW FlashWindowEx CreateIconFromResourceEx SetWindowTextW GetForegroundWindow GetClassNameW MessageBoxW DestroyMenu DestroyIcon DestroyAcceleratorTable CreateAcceleratorTableW SetMenu DrawMenuBar RemoveMenu CheckMenuItem ShowWindow SystemParametersInfoA GetMenuBarInfo GetWindowRect AppendMenuW SetForegroundWindow TrackPopupMenu CreateWindowExW SetWindowsHookExW GetMessageW TranslateMessage RegisterWindowMessageA DispatchMessageW CreateMenu CreatePopupMenu DestroyWindow SendMessageW GetMessageA DispatchMessageA CallWindowProcW SetWindowLongPtrW RemovePropW DefWindowProcW SetCursorPos GetSystemMenu EnableMenuItem SetWindowLongW SetWindowPlacement GetClipCursor ClipCursor ShowCursor GetWindowLongW AdjustWindowRectEx IsIconic PostQuitMessage PostMessageW GetSystemMetrics RegisterTouchWindow InvalidateRgn RedrawWindow MonitorFromWindow ReleaseDC GetDC GetActiveWindow MonitorFromPoint RegisterClassExW GetKeyboardState GetAsyncKeyState GetKeyState TrackMouseEvent ScreenToClient GetTouchInputInfo CloseClipboard MonitorFromRect GetMonitorInfoW ValidateRect MapVirtualKeyW IsClipboardFormatAvailable GetClipboardData EmptyClipboard SetClipboardData GetClassInfoExW SendInput GetMenuItemInfoW MapWindowPoints OffsetRect GetWindowDC FillRect DrawTextW DrawIconEx SetMenuItemInfoW SetCapture ReleaseCapture ChangeDisplaySettingsExW GetKeyboardLayout MapVirtualKeyExW ToUnicodeEx EnumDisplayMonitors ClientToScreen GetRawInputData RegisterHotKey RegisterRawInputDevices RegisterClassW CloseTouchInputHandle OpenClipboard

ole32

CoCreateInstance CoInitializeEx RevokeDragDrop CoUninitialize CoTaskMemFree CoCreateFreeThreadedMarshaler CoInitialize OleInitialize RegisterDragDrop

oleaut32

SysAllocStringLen GetErrorInfo SysStringLen SetErrorInfo SysFreeString SafeArrayCreateVector SafeArrayPutElement

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

opengl32

wglMakeCurrent wglGetCurrentContext wglGetProcAddress wglGetCurrentDC wglCreateContext wglShareLists wglDeleteContext

shlwapi

AssocQueryStringW

shell32

Shell_NotifyIconGetRect DragQueryFileW DragFinish Shell_NotifyIconW

gdi32

DescribePixelFormat ChoosePixelFormat SetBkMode DeleteObject SwapBuffers CreateRectRgn GetDeviceCaps SetPixelFormat SetTextColor DeleteDC SelectObject CreateDIBSection CreateCompatibleDC CreateSolidBrush

advapi32

RegCloseKey RegSetValueExW RegQueryValueExW ImpersonateAnonymousToken RevertToSelf RegEnumKeyExW EventRegister EventSetInformation EventWriteTransfer RegGetValueW EventUnregister RegOpenKeyExW

uiautomationcore

UiaGetReservedNotSupportedValue UiaRaiseAutomationPropertyChangedEvent UiaLookupId UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetCompositionStringW ImmReleaseContext ImmGetContext ImmAssociateContextEx

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpCrackUrl WinHttpOpen

uxtheme

SetWindowTheme

vcruntime140

_CxxThrowException __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __current_exception_context __current_exception memcpy __C_specific_handler memmove memset wcsrchr memcmp _purecall

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

ceilf floorf powf roundf round trunc __setusermatherr _hypotf fmod cos cbrtf floor sin atan2f expf exp2f cosf acosf sinf

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen wcslen wcscmp

api-ms-win-crt-runtime-l1-1-0

strerror _cexit _seh_filter_exe _set_app_type terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _crt_atexit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-05_4dfc0eaeb354d98502996f71a180b2aa_akira_cobalt-strike_rusty-stealer_satacom

kernel32

user32

ole32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

opengl32

shlwapi

shell32

gdi32

advapi32

uiautomationcore

dwmapi

imm32

comctl32

winhttp

uxtheme

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic