2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom
Size 242KB
Sample260910-gj8yjaygnd
SHA256 589426de118fbfade18493720767725ecd21b79d1806f701d203123653f8804b
MD5 4f300aca13957a1390b1be96fef24782
SHA1 cb5302d76a77f69d4f2300d4799a82f4457cf6c8
SHA512 b595851c5f46658b27845b55b5b81351d18cb73e825d36dbfaa44a52e27be428fdd1bcded49f8cd794234163a99811c85612dd6db2f121f913fd90ec903aee22
SSDEEP 3072:flU2MSeJFn1KVUxLDkIYL0rG4Ndr+Ze1EWsJ0u9ZVUwhRjbFm0+mVUBZhru:theTQUxcL0rGOZ1EJ0uZVU70+mmBLu
TLSH
T1FC345B153A8A4DF9D457C07983858A73AA3278CA0B31E9FF06D551352F2AEF56F3C608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom

.exe 242KB

2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH aa384558c72071cf58a68fe2a5bbeee4
SHA256 589426de118fbfade18493720767725ecd21b79d1806f701d203123653f8804b
MD5 4f300aca13957a1390b1be96fef24782
SHA1 cb5302d76a77f69d4f2300d4799a82f4457cf6c8
SHA512 b595851c5f46658b27845b55b5b81351d18cb73e825d36dbfaa44a52e27be428fdd1bcded49f8cd794234163a99811c85612dd6db2f121f913fd90ec903aee22
SSDEEP 3072:flU2MSeJFn1KVUxLDkIYL0rG4Ndr+Ze1EWsJ0u9ZVUwhRjbFm0+mVUBZhru:theTQUxcL0rGOZ1EJ0uZVU70+mmBLu
TLSH
T1FC345B153A8A4DF9D457C07983858A73AA3278CA0B31E9FF06D551352F2AEF56F3C608
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

17:17:ca:9a:1a:81:75:a9:b5:fe:70:be:7d:45:3a:7d:d2:44:58:c5:6b:3a:9a:70:78:68:66:50:fc:ca:c7:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 9, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

173216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

SetUnhandledExceptionFilter GetCommandLineW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetLastError GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA CloseHandle ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW WriteFileEx SleepEx ReadFileEx GetModuleHandleW FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter SetHandleInformation GetModuleHandleA GetFullPathNameW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateFileW CreateThread GetTickCount SwitchToThread FreeLibrary LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeSListHead GetSystemTimeAsFileTime

ntdll

RtlNtStatusToDosError NtWriteFile NtOpenFile NtCreateNamedPipeFile

ws2_32

send freeaddrinfo getaddrinfo closesocket WSAGetLastError WSASocketW WSACleanup WSAStartup connect recv

advapi32

RegOpenKeyExW RegCloseKey

vcruntime140

__current_exception_context memcmp __CxxFrameHandler3 memmove __C_specific_handler memcpy __current_exception memset

api-ms-win-crt-string-l1-1-0

wcscat_s wcscpy_s _wcsicmp wcslen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _seh_filter_exe terminate exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_4f300aca13957a1390b1be96fef24782_akira_cobalt-strike_rusty-stealer_satacom

PE Signature issue

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic