589426de118fbfade18493720767725ecd21b79d1806f701d203123653f8804b

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 242KB
Sample260910-gj8yjaygnd
SHA256 589426de118fbfade18493720767725ecd21b79d1806f701d203123653f8804b
MD5 4f300aca13957a1390b1be96fef24782
SHA1 cb5302d76a77f69d4f2300d4799a82f4457cf6c8
SHA512 b595851c5f46658b27845b55b5b81351d18cb73e825d36dbfaa44a52e27be428fdd1bcded49f8cd794234163a99811c85612dd6db2f121f913fd90ec903aee22
SSDEEP 3072:flU2MSeJFn1KVUxLDkIYL0rG4Ndr+Ze1EWsJ0u9ZVUwhRjbFm0+mVUBZhru:theTQUxcL0rGOZ1EJ0uZVU70+mmBLu
TLSH
T1FC345B153A8A4DF9D457C07983858A73AA3278CA0B31E9FF06D551352F2AEF56F3C608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom.exe
3220	2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads