2026-10-16_79250a3dc7922516964afdcb1d16f858_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_79250a3dc7922516964afdcb1d16f858_akira_cobalt-strike_rusty-stealer_satacom
Size 7.4MB
Sample261017-rfc2ssvthz
SHA256 ca2ba284741844b8b473593178bdc8854efff45c7167e95ed431d933816c6f5c
MD5 79250a3dc7922516964afdcb1d16f858
SHA1 d79fefcb16bcabb7e702a1a4f3c61c2749ce3f04
SHA512 8da66f914c7b4d96fdfb070bd82dfd50f43ca91f41f58e36f460fe9040cbee71860dfaa39702bc3d6b6b78ad698d3764353a4e62b3f2ea3dca76b6b28ffb7b2d
SSDEEP 98304:oLznFZ2ClKaFtgux75vEsGEujmkjm9HqVCFjKZNnoCT:yqVPZN
TLSH
T16E760711BE9B5858D08ACCB0C3878A678E2131DB193AB8BF55C9523D3F2D7F45F1921A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-16_79250a3dc7922516964afdcb1d16f858_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-16_79250a3dc7922516964afdcb1d16f858_akira_cobalt-strike_rusty-stealer_satacom

.exe 7.4MB

2026-10-16_79250a3dc7922516964afdcb1d16f858_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 395065908b385b8b42531d2ea75e94b8
SHA256 ca2ba284741844b8b473593178bdc8854efff45c7167e95ed431d933816c6f5c
MD5 79250a3dc7922516964afdcb1d16f858
SHA1 d79fefcb16bcabb7e702a1a4f3c61c2749ce3f04
SHA512 8da66f914c7b4d96fdfb070bd82dfd50f43ca91f41f58e36f460fe9040cbee71860dfaa39702bc3d6b6b78ad698d3764353a4e62b3f2ea3dca76b6b28ffb7b2d
SSDEEP 98304:oLznFZ2ClKaFtgux75vEsGEujmkjm9HqVCFjKZNnoCT:yqVPZN
TLSH
T16E760711BE9B5858D08ACCB0C3878A678E2131DB193AB8BF55C9523D3F2D7F45F1921A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

36:a8:42:f1:37:0c:50:ef:04:11:46:92:f9:6a:7e:16:c3:8b:66:6f:18:68:b4:8a:10:40:38:a6:8d:81:fb:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TurNT_,O=TurNT_,C=US

Chains

Oct 13, 2026

CN=TurNT_,O=TurNT_,C=US

Subject

CN=TurNT_,O=TurNT_,C=US

Serial Number

63:98:75:2e:33:1c:53:aa:43:cf:d2:62:30:b4:a5:82

Issuer

CN=TurNT_ Root CA,O=TurNT_,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 23, 2026 - Aug 23, 2031

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5301600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

turnt_galaxygen.pdb

bcryptprimitives

ProcessPrng

ntdll

NtReadFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile NtOpenFile NtCreateNamedPipeFile

kernel32

FindClose GetCurrentThreadId GetFileInformationByHandleEx CreateDirectoryW ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW CreateWaitableTimerExW SetWaitableTimer FindNextFileW LoadLibraryW FormatMessageW GetModuleHandleW SleepEx RtlLookupFunctionEntry HeapAlloc SwitchToThread LoadLibraryA MultiByteToWideChar WaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer SetFileInformationByHandle WideCharToMultiByte SetUnhandledExceptionFilter RtlUnwindEx GetFinalPathNameByHandleW SetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetLastError QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetQueuedCompletionStatusEx lstrlenW FindFirstFileExW CreateMutexA GetCurrentProcessId HeapFree SetFileTime HeapReAlloc GetProcessHeap GetCurrentThread FreeLibrary LoadLibraryExW CreateFileW GetFullPathNameW OutputDebugStringW OutputDebugStringA LoadLibraryExA SetThreadStackGuarantee InitializeSListHead DeleteCriticalSection GetModuleHandleA CreateMutexW GetSystemTimePreciseAsFileTime GetSystemInfo Sleep GetCurrentProcess GetProcAddress GetLastError CloseHandle LCIDToLocaleName GetUserDefaultUILanguage CreateThread MoveFileExW FlushFileBuffers WaitForSingleObjectEx InitializeCriticalSectionEx GetFileInformationByHandle

shell32

SHAppBarMessage Shell_NotifyIconGetRect SHOpenFolderAndSelectItems ShellExecuteW ILFree ILCreateFromPathW SHGetStockIconInfo DragFinish SHGetKnownFolderPath DragQueryFileW ShellExecuteExW SHCreateItemFromParsingName Shell_NotifyIconW

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass TaskDialogIndirect

user32

GetWindowThreadProcessId AllowSetForegroundWindow SendMessageTimeoutW PostThreadMessageW DispatchMessageW MonitorFromRect IsWindow CloseDesktop CloseTouchInputHandle GetWindow SetFocus GetTouchInputInfo TrackMouseEvent ScreenToClient OpenInputDesktop DestroyWindow GetKeyState GetAsyncKeyState SetWindowLongPtrW IsZoomed EnumWindows CreateIcon GetIconInfo LoadImageW RegisterTouchWindow CreateWindowExW SetCapture RegisterClassExW TranslateAcceleratorW UpdateWindow ChangeWindowMessageFilterEx InvalidateRect SetCursorPos SetCursor RegisterClassW LoadCursorW GetForegroundWindow FlashWindowEx GetUpdateRect GetRawInputData IsWindowEnabled EnableWindow IsIconic IsWindowVisible EnumDisplayMonitors RedrawWindow GetWindowLongPtrW MsgWaitForMultipleObjectsEx SetPropW GetKeyboardState MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity MapVirtualKeyW ToUnicodeEx MapVirtualKeyExW GetMessageW GetKeyboardLayout ClipCursor GetSystemMetrics GetClipCursor ShowCursor SystemParametersInfoW SetParent GetMonitorInfoW GetWindowPlacement SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW SetWindowLongW GetSystemMenu RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn SetWindowPos ReleaseCapture EnumChildWindows FindWindowExW GetParent RegisterWindowMessageA DispatchMessageA GetMessageA AdjustWindowRect GetClassNameW FindWindowW IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos AppendMenuW InsertMenuW SetMenu CreatePopupMenu CreateMenu DrawIconEx GetDC SetWindowRgn VkKeyScanW EnableMenuItem DestroyIcon SetMenuItemInfoW DrawMenuBar SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW SystemParametersInfoA ShowWindow SendMessageW PostQuitMessage CreateAcceleratorTableW PostMessageW GetActiveWindow DestroyAcceleratorTable DestroyMenu RemoveMenu ValidateRect SetTimer KillTimer DefWindowProcW TranslateMessage

gdi32

GetDIBits BitBlt CreateRectRgn DeleteObject SetBkMode SetTextColor CreateSolidBrush CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDeviceCaps CombineRgn

ole32

CoInitializeEx CoUninitialize RevokeDragDrop RegisterDragDrop CoInitialize OleInitialize CoCreateInstance

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

advapi32

RegQueryValueExW EventSetInformation RegOpenKeyExW RegCreateKeyExW RegDeleteValueW RegSetValueExW RegCloseKey EventRegister EventUnregister EventWriteTransfer RegGetValueW

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext

shlwapi

SHCreateMemStream

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-crt-math-l1-1-0

pow __setusermatherr trunc floor round roundf

api-ms-win-crt-string-l1-1-0

strlen _wcsicmp wcslen wcscmp strcpy_s

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argc _seh_filter_exe _set_app_type _exit _initialize_onexit_table _crt_atexit exit _initialize_narrow_environment _get_initial_narrow_environment _initterm __p___argv terminate _configure_narrow_argv abort _register_thread_local_exe_atexit_callback _cexit _initterm_e _c_exit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh _set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_79250a3dc7922516964afdcb1d16f858_akira_cobalt-strike_rusty-stealer_satacom

PE Signature issue

bcryptprimitives

ntdll

kernel32

shell32

combase

api-ms-win-core-synch-l1-2-0

comctl32

user32

gdi32

ole32

oleaut32

advapi32

dwmapi

imm32

shlwapi

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic