2026-10-02_20f90c3fdcc29ca9140b9aa3f80e3ef2_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_20f90c3fdcc29ca9140b9aa3f80e3ef2_akira_cobalt-strike_rusty-stealer_satacom
Size 134KB
Sample261003-tkq6bseb52
SHA256 8890981c558eb23666acbb8d13dafddfb6eebae20af977c626502211a246ed5f
MD5 20f90c3fdcc29ca9140b9aa3f80e3ef2
SHA1 0fd1ea7b8cd2083a46ce1dae7a68d952173e55cb
SHA512 cb1986c7dbf3bedca1827de1d70a953ec5710e7ff447c929e78fbb18e4c943f65ebd5f8731902321f66b4c65b90a971265453fab8862ca14a79a5e9ecdaf3565
SSDEEP 3072:AUs9QhWQVdLf/5AGYJldpPbrJtO0uiMHRQ3mdB1CG:AihDr3iGYbdpPb1z930h
TLSH
T16AD35C13764565F8E406C078C7158663BB76FCE90B226AFF566821343F19AEA7F38B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_20f90c3fdcc29ca9140b9aa3f80e3ef2_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-02_20f90c3fdcc29ca9140b9aa3f80e3ef2_akira_cobalt-strike_rusty-stealer_satacom

.exe 134KB

2026-10-02_20f90c3fdcc29ca9140b9aa3f80e3ef2_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 517c267255fadc2a6ea90fd9597dce2d
SHA256 8890981c558eb23666acbb8d13dafddfb6eebae20af977c626502211a246ed5f
MD5 20f90c3fdcc29ca9140b9aa3f80e3ef2
SHA1 0fd1ea7b8cd2083a46ce1dae7a68d952173e55cb
SHA512 cb1986c7dbf3bedca1827de1d70a953ec5710e7ff447c929e78fbb18e4c943f65ebd5f8731902321f66b4c65b90a971265453fab8862ca14a79a5e9ecdaf3565
SSDEEP 3072:AUs9QhWQVdLf/5AGYJldpPbrJtO0uiMHRQ3mdB1CG:AihDr3iGYbdpPb1z930h
TLSH
T16AD35C13764565F8E406C078C7158663BB76FCE90B226AFF566821343F19AEA7F38B10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

process_hollowing.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject CloseHandle Sleep QueryPerformanceFrequency GetCurrentProcess VirtualAllocExNuma CreateProcessA GetProcessHeap HeapFree GetLastError HeapReAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId SetLastError GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetModuleHandleW FormatMessageW GetModuleHandleA

ntdll

NtQueryInformationProcess RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __C_specific_handler memmove memset __CxxFrameHandler3 memcpy memcmp __current_exception_context

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _get_initial_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _seh_filter_exe _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_20f90c3fdcc29ca9140b9aa3f80e3ef2_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic