2026-09-26_bdbbfc97442e37930228eb1c4ee7795d_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_bdbbfc97442e37930228eb1c4ee7795d_akira_cobalt-strike_rusty-stealer_satacom
Size 227KB
Sample260926-s6rtbaeh48
SHA256 3b087bcf7df981ab1b5159aba3729b462ec0669f021528108c334f44ee339dee
MD5 bdbbfc97442e37930228eb1c4ee7795d
SHA1 e6f2216597dbea05c97d408478bcc6dc57bf067c
SHA512 30208dfbd16040b51a97b82f453235c6c47df4264bc6408ddb6acdc13569eec994b3eb9f5ab46fff83586d2381c8c48401833b85c48e732696999b0ae6e97309
SSDEEP 3072:ize66c3THuOpPes5n7pdmuBZruR1L+RDC8dhi+VHwboiGW0oYIYbbXiBdW8:+HuOpPe+n7pdmxQDCAi+VH4ojfiv9
TLSH
T1F5347E2576549CFEC88BC07483458A62B67274CA0B31E9FF12D58234AF6ADF62F3C654
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-26_bdbbfc97442e37930228eb1c4ee7795d_akira_cobalt-strike_rusty-stealer_satacom

.exe 227KB

2026-09-26_bdbbfc97442e37930228eb1c4ee7795d_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 0beb5a88cda23fe2c1724a1f9fb80c0c
SHA256 3b087bcf7df981ab1b5159aba3729b462ec0669f021528108c334f44ee339dee
MD5 bdbbfc97442e37930228eb1c4ee7795d
SHA1 e6f2216597dbea05c97d408478bcc6dc57bf067c
SHA512 30208dfbd16040b51a97b82f453235c6c47df4264bc6408ddb6acdc13569eec994b3eb9f5ab46fff83586d2381c8c48401833b85c48e732696999b0ae6e97309
SSDEEP 3072:ize66c3THuOpPes5n7pdmuBZruR1L+RDC8dhi+VHwboiGW0oYIYbbXiBdW8:+HuOpPe+n7pdmxQDCAi+VH4ojfiv9
TLSH
T1F5347E2576549CFEC88BC07483458A62B67274CA0B31E9FF12D58234AF6ADF62F3C654
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

7f:b5:53:96:97:58:cf:c1:4b:3f:fb:50:b3:a7:4a:68:64:6a:22:b1:2f:3f:39:45:e5:16:22:f8:3c:94:d8:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=UAB Simoresta,O=UAB Simoresta,L=Slengiu kaimas,ST=Klaipedos,C=LT

Chains

Aug 4, 2026

CN=UAB Simoresta,O=UAB Simoresta,L=Slengiu kaimas,ST=Klaipedos,C=LT

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=UAB Simoresta,O=UAB Simoresta,L=Slengiu kaimas,ST=Klaipedos,C=LT

Serial Number

33:00:03:d1:7f:cd:be:61:99:8b:05:7d:b7:00:00:00:03:d1:7f

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 5, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

152576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wg_service_host.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

SetFileInformationByHandle GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCommandLineW UnhandledExceptionFilter GetEnvironmentVariableW GetStdHandle GetCurrentProcessId GetCurrentDirectoryW SetLastError GetSystemTimePreciseAsFileTime RtlVirtualUnwind GetProcessHeap HeapFree RtlLookupFunctionEntry lstrlenW ReleaseMutex IsDebuggerPresent FindClose CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW FindFirstFileExW RtlCaptureContext GetConsoleMode QueryPerformanceCounter GetModuleHandleW FormatMessageW ExitProcess GetFullPathNameW GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WideCharToMultiByte GetModuleHandleA HeapAlloc WaitForSingleObject WaitForSingleObjectEx LoadLibraryA CreateMutexA GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetUnhandledExceptionFilter SetThreadErrorMode GetModuleFileNameW FreeLibrary GetProcAddress GetLastError LoadLibraryExW CloseHandle GetCurrentProcess HeapReAlloc IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

memcmp memcpy memmove _CxxThrowException __C_specific_handler __current_exception memset __CxxFrameHandler3 __current_exception_context

api-ms-win-crt-runtime-l1-1-0

exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _configure_narrow_argv _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _initterm _seh_filter_exe _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_bdbbfc97442e37930228eb1c4ee7795d_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic