2026-09-26_59c2907f2ed731b4f215160e62dce820_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_59c2907f2ed731b4f215160e62dce820_akira_cobalt-strike_rusty-stealer_satacom
Size 9.1MB
Sample260926-191jmasfre
SHA256 2b63ca49e30886972a0b42191392c850a1f0767ae7690972929c58bcdb0292d2
MD5 59c2907f2ed731b4f215160e62dce820
SHA1 e33d1ebdd4c2e9afa7ba7edc0809c5f98cbbf8ac
SHA512 9ec374169293e50a1e687cc45ebffea763f223f4a0795643e0fa5c7e6823081864f436a74b7f5aee70a12cb38a7c0bfbb43663534cf25fcf073a782ed97e6666
SSDEEP 98304:AH40cpx39eYSCbbcGWP99Xw+PSQoMH90qTV/Wl6XPcFU:a8U+cpZlc
TLSH
T111A607117A9A64ACC1AAC470834B8A736A3130CB1B39B9FF44D496753F79AF45B3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_59c2907f2ed731b4f215160e62dce820_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-09-26_59c2907f2ed731b4f215160e62dce820_akira_cobalt-strike_rusty-stealer_satacom

.exe 9.1MB

2026-09-26_59c2907f2ed731b4f215160e62dce820_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH fc48ebd3978d0e2f05de3434dc50829b
SHA256 2b63ca49e30886972a0b42191392c850a1f0767ae7690972929c58bcdb0292d2
MD5 59c2907f2ed731b4f215160e62dce820
SHA1 e33d1ebdd4c2e9afa7ba7edc0809c5f98cbbf8ac
SHA512 9ec374169293e50a1e687cc45ebffea763f223f4a0795643e0fa5c7e6823081864f436a74b7f5aee70a12cb38a7c0bfbb43663534cf25fcf073a782ed97e6666
SSDEEP 98304:AH40cpx39eYSCbbcGWP99Xw+PSQoMH90qTV/Wl6XPcFU:a8U+cpZlc
TLSH
T111A607117A9A64ACC1AAC470834B8A736A3130CB1B39B9FF44D496753F79AF45B3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7490176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

xtask.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

FindNextFileW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CloseHandle GetCurrentProcess K32GetProcessMemoryInfo GetSystemInfo GetLastError GetModuleHandleW GetProcAddress CreateFileW GetFileInformationByHandleEx SetFileInformationByHandle GetErrorMode SetErrorMode CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId MoveFileExW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetProcessId TerminateProcess GetEnvironmentStringsW GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW SetFileAttributesW CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW FormatMessageW WaitForMultipleObjects GetModuleHandleA GetTempPathW

ntdll

NtWriteFile NtOpenFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError

bcrypt

BCryptDestroyHash BCryptHashData BCryptGetProperty BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash

vcruntime140

_CxxThrowException memmove __current_exception_context __current_exception __C_specific_handler memcmp memset __CxxFrameHandler3 memcpy

api-ms-win-crt-math-l1-1-0

fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit terminate __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type __p___argv _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_59c2907f2ed731b4f215160e62dce820_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic