2026-09-24_25d8e90f4542d31d90ef7b292e3038c5_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_25d8e90f4542d31d90ef7b292e3038c5_akira_cobalt-strike_rusty-stealer_satacom
Size 25.2MB
Sample260925-qh99msed28
SHA256 7561e45b2b3d597ac0f129681238b1c622e83e0ff3d711e64e1122ed15f5c39c
MD5 25d8e90f4542d31d90ef7b292e3038c5
SHA1 71cbc0cd021d4e6fe5a39b5bf2adc1b356cd947d
SHA512 e2ad8e005cae5bc722d7eeef8e375fd1b0688b94da3817b95173f7e7d4a927e91183e8b546819f3be6ab039330e7f9af61c5218ce51b372caa909cbb0dad2395
SSDEEP 98304:EJrd8c3JYb+0qb0vt6fTH+FNAfssp/lDMqNoj4hPxaQrKnNYxaN0Yvhl:0pv3JY606cE692rKVNh
TLSH
T1CB47A716B67990D9D17EC0B883879F23B920789D47393BF789C086662F64EF4A93C750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_25d8e90f4542d31d90ef7b292e3038c5_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-09-24_25d8e90f4542d31d90ef7b292e3038c5_akira_cobalt-strike_rusty-stealer_satacom

.exe 25.2MB

2026-09-24_25d8e90f4542d31d90ef7b292e3038c5_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH f2ce09c49f944e97bbd60a223c6bba30
SHA256 7561e45b2b3d597ac0f129681238b1c622e83e0ff3d711e64e1122ed15f5c39c
MD5 25d8e90f4542d31d90ef7b292e3038c5
SHA1 71cbc0cd021d4e6fe5a39b5bf2adc1b356cd947d
SHA512 e2ad8e005cae5bc722d7eeef8e375fd1b0688b94da3817b95173f7e7d4a927e91183e8b546819f3be6ab039330e7f9af61c5218ce51b372caa909cbb0dad2395
SSDEEP 98304:EJrd8c3JYb+0qb0vt6fTH+FNAfssp/lDMqNoj4hPxaQrKnNYxaN0Yvhl:0pv3JY606cE692rKVNh
TLSH
T1CB47A716B67990D9D17EC0B883879F23B920789D47393BF789C086662F64EF4A93C750
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21314208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

xtask.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CloseHandle GetSystemInfo GetLastError GetModuleHandleW GetProcAddress CreateFileW GetCurrentProcess K32GetProcessMemoryInfo SetFileInformationByHandle GetFileInformationByHandleEx GetErrorMode SetErrorMode CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetProcessId TerminateProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW FormatMessageW WaitForMultipleObjects GetModuleHandleA GetTempPathW FindNextFileW

ntdll

NtWriteFile NtOpenFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError

bcrypt

BCryptGetProperty BCryptSetProperty BCryptCreateHash BCryptHashData BCryptFinishHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyHash

vcruntime140

_CxxThrowException memcpy __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memcmp memmove memset

api-ms-win-crt-math-l1-1-0

fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit terminate __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type __p___argv _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_25d8e90f4542d31d90ef7b292e3038c5_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic