2026-09-25_8ea5b4f43ad710fe5ecfbdb39fd340da_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_8ea5b4f43ad710fe5ecfbdb39fd340da_akira_cobalt-strike_rusty-stealer_satacom
Size 276KB
Sample260925-2ze1lsab45
SHA256 403188cc7d7fa10e2edf85a2a2c10afea1c7642662c05a0dba855bd3c61bfff6
MD5 8ea5b4f43ad710fe5ecfbdb39fd340da
SHA1 2eecf756b8c59491a45644f56574affb7c9bf99e
SHA512 e604534ad05cc6e42b9714486f986a0c5c73968f0a02566833330bae7ed7248f78e4e5abeb877c44ea27ba876bce82d15f63a9e9aa7e7e36d9457753ce3662b3
SSDEEP 6144:q91eeeajI9QKXYfFY0G0I7zISIjA16SScsmxqdIO1u:U13MzXAWkZdI
TLSH
T164545B167A5688BDD45AC438C3568A73AA3374C60B32E9FF15E055342F2BAE56F3C708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_8ea5b4f43ad710fe5ecfbdb39fd340da_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-09-25_8ea5b4f43ad710fe5ecfbdb39fd340da_akira_cobalt-strike_rusty-stealer_satacom

.exe 276KB

2026-09-25_8ea5b4f43ad710fe5ecfbdb39fd340da_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 0f0870fc45c9474b2b7ed42b817776a8
SHA256 403188cc7d7fa10e2edf85a2a2c10afea1c7642662c05a0dba855bd3c61bfff6
MD5 8ea5b4f43ad710fe5ecfbdb39fd340da
SHA1 2eecf756b8c59491a45644f56574affb7c9bf99e
SHA512 e604534ad05cc6e42b9714486f986a0c5c73968f0a02566833330bae7ed7248f78e4e5abeb877c44ea27ba876bce82d15f63a9e9aa7e7e36d9457753ce3662b3
SSDEEP 6144:q91eeeajI9QKXYfFY0G0I7zISIjA16SScsmxqdIO1u:U13MzXAWkZdI
TLSH
T164545B167A5688BDD45AC438C3568A73AA3374C60B32E9FF15E055342F2BAE56F3C708
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

202480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hostservice.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

gdi32

SelectObject CreateDCW DeleteDC DeleteObject CreateCompatibleDC CreateCompatibleBitmap BitBlt GetDIBits

kernel32

InitializeSListHead SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetSystemTime GlobalMemoryStatusEx GetCurrentProcessId GetCurrentThreadId GetTickCount GetCommandLineW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetLastError SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW CreateMutexA CloseHandle ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW WriteFileEx SleepEx ReadFileEx QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter SetHandleInformation CreateThread GetModuleHandleA GetFullPathNameW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateFileW CreateWaitableTimerExW SetWaitableTimer Sleep SwitchToThread WriteProcessMemory FreeLibrary LoadLibraryW

user32

EnumDisplayMonitors GetSystemMetrics ReleaseDC GetWindowDC SendInput GetWindowRect GetDesktopWindow GetDC

ntdll

RtlNtStatusToDosError NtCreateNamedPipeFile NtOpenFile NtWriteFile

ws2_32

ioctlsocket connect getsockopt WSADuplicateSocketW send freeaddrinfo recv getaddrinfo setsockopt closesocket WSAGetLastError WSASocketW WSACleanup WSAStartup select

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy memmove memset memcpy memcmp __CxxFrameHandler3 __C_specific_handler __current_exception_context __current_exception

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr cos sin

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_initterm exit _exit _get_initial_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_8ea5b4f43ad710fe5ecfbdb39fd340da_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

gdi32

kernel32

user32

ntdll

ws2_32

msvcp140

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic