2026-10-18_7fad911e84713a87465b5585cdd395f7_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_7fad911e84713a87465b5585cdd395f7_akira_cobalt-strike_rusty-stealer_satacom
Size 4.0MB
Sample261018-phktbaag52
SHA256 143b6864ff5428790f59d95fd6ac6fc2d78ccadb1b2cad4f08469935f8b67714
MD5 7fad911e84713a87465b5585cdd395f7
SHA1 94082f319c6437788a199dd64fd12e315c33967f
SHA512 82fafbed4e9fb351a18ca040c71b261920fd99c508e45bcbd4628b639892a3e1d3d7a15f5df59b642ed713cc37b0b24f8fa360df88a37897764d33c1dee1201b
SSDEEP 49152:3ykmNZHZDjmohRKtZZB8waDU/1K3Qw+0AY8pG84jqtkV8Y1r4fr7Puur1LOCDW5/:hrFpY7r
TLSH
T16F16F8166A29A4EDC1BBC07992879F72A92130D807397BF7459082763F38EF86D3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_7fad911e84713a87465b5585cdd395f7_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-18_7fad911e84713a87465b5585cdd395f7_akira_cobalt-strike_rusty-stealer_satacom

.exe 4.0MB

2026-10-18_7fad911e84713a87465b5585cdd395f7_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 3174f6e1b28f4e297c33f99273350ae8
SHA256 143b6864ff5428790f59d95fd6ac6fc2d78ccadb1b2cad4f08469935f8b67714
MD5 7fad911e84713a87465b5585cdd395f7
SHA1 94082f319c6437788a199dd64fd12e315c33967f
SHA512 82fafbed4e9fb351a18ca040c71b261920fd99c508e45bcbd4628b639892a3e1d3d7a15f5df59b642ed713cc37b0b24f8fa360df88a37897764d33c1dee1201b
SSDEEP 49152:3ykmNZHZDjmohRKtZZB8waDU/1K3Qw+0AY8pG84jqtkV8Y1r4fr7Puur1LOCDW5/:hrFpY7r
TLSH
T16F16F8166A29A4EDC1BBC07992879F72A92130D807397BF7459082763F38EF86D3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2989404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gold_research-ef92f6b1cfa0c9d2.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

FormatMessageW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetEnvironmentStringsW CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileType GetModuleHandleW WaitForMultipleObjects GetModuleHandleA GetTempPathW

ntdll

NtWriteFile NtOpenFile NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError

userenv

GetUserProfileDirectoryW

vcruntime140

memcmp memcpy __current_exception __C_specific_handler _CxxThrowException __CxxFrameHandler3 memset __current_exception_context memmove

api-ms-win-crt-math-l1-1-0

log exp ceil pow floor _hypot round fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _crt_atexit __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type __p___argc _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_7fad911e84713a87465b5585cdd395f7_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic