2026-10-18_01ee54d70ad3c042501003d89bf9f9e3_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_01ee54d70ad3c042501003d89bf9f9e3_akira_cobalt-strike_rusty-stealer_satacom
Size 18.7MB
Sample261018-xdklrags2p
SHA256 8156f1b86da7cb791b2a7528ed9c8339a68387638146f1b3d5cefb04d2495ef3
MD5 01ee54d70ad3c042501003d89bf9f9e3
SHA1 26ffe4739727a511b8dd2bc7ad7b49f59aea0cbe
SHA512 3a824693dcf72a9272c199bf3eccb506e9b702765dacf986c60927b0a10060c8b3c03e5c0a0b0e9ff9571391428761a697c64c2a3d01b8368e75ada3cb73a2c6
SSDEEP 98304:FWy3U20XoosI2T23qLCvX7Q4JwmEVNXg1zfEzONaVh:g5p+I2n0X0swhHKNaV
TLSH
T11417D616677960D9C17BC0B882838F62A92174DD0B397BF749D1827A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_01ee54d70ad3c042501003d89bf9f9e3_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-18_01ee54d70ad3c042501003d89bf9f9e3_akira_cobalt-strike_rusty-stealer_satacom

.exe 18.7MB

2026-10-18_01ee54d70ad3c042501003d89bf9f9e3_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH d7651d46f6f5d43303679185febbf087
SHA256 8156f1b86da7cb791b2a7528ed9c8339a68387638146f1b3d5cefb04d2495ef3
MD5 01ee54d70ad3c042501003d89bf9f9e3
SHA1 26ffe4739727a511b8dd2bc7ad7b49f59aea0cbe
SHA512 3a824693dcf72a9272c199bf3eccb506e9b702765dacf986c60927b0a10060c8b3c03e5c0a0b0e9ff9571391428761a697c64c2a3d01b8368e75ada3cb73a2c6
SSDEEP 98304:FWy3U20XoosI2T23qLCvX7Q4JwmEVNXg1zfEzONaVh:g5p+I2n0X0swhHKNaV
TLSH
T11417D616677960D9C17BC0B882838F62A92174DD0B397BF749D1827A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14643920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

recording_contracts-3574a1218696f1c1.pdb

bcryptprimitives

ProcessPrng

kernel32

GetSystemTime GetTickCount FlushFileBuffers GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WideCharToMultiByte CloseHandle FreeLibrary GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile LoadLibraryW GetSystemInfo DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA GetTempPathA Sleep MultiByteToWideChar GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile GetFullPathNameW ReadFile AreFileApisANSI GetCurrentThreadId CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetOverlappedResult GetSystemTimeAsFileTime DeleteFileW RtlVirtualUnwind InitializeSListHead GetModuleHandleA WaitForMultipleObjects GetModuleHandleW GetFileType GetConsoleOutputCP GetConsoleMode WriteConsoleW GetModuleFileNameW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetEnvironmentStringsW GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CancelIo GetSystemTimePreciseAsFileTime SetUnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess ReadFileEx CreateEventW CreateThread QueryPerformanceFrequency SetFileTime SetFileInformationByHandle SetLastError SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException HeapCreate HeapFree OutputDebugStringA UnmapViewOfFile HeapValidate HeapSize FormatMessageW OutputDebugStringW FlushViewOfFile HeapReAlloc HeapAlloc HeapCompact HeapDestroy GetProcessHeap SystemTimeToFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

NtOpenFile NtWriteFile NtReadFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcmp memset memmove strchr strrchr memcpy __C_specific_handler memchr _CxxThrowException __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod floor log pow round

api-ms-win-crt-string-l1-1-0

strncmp strspn strlen strcmp strcspn

api-ms-win-crt-heap-l1-1-0

_msize free _set_new_mode malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _initialize_onexit_table _initterm _register_onexit_function _initterm_e exit _exit _set_app_type _configure_narrow_argv _beginthreadex _endthreadex __p___argc _initialize_narrow_environment __p___argv _crt_atexit _cexit _get_initial_narrow_environment _c_exit _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_01ee54d70ad3c042501003d89bf9f9e3_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic