2026-10-20_5bfa27d1a0ab0c9efb37703cb117c4df_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-20_5bfa27d1a0ab0c9efb37703cb117c4df_akira_cobalt-strike_rusty-stealer_satacom
Size 1.5MB
Sample261020-hpkcsset2z
SHA256 3f20c4ab13e97970358b361ffcadb6b797b656be5d6555a995dd1b104e311d63
MD5 5bfa27d1a0ab0c9efb37703cb117c4df
SHA1 f7d0daa89c2264a9c8e2610dece639d2a428fb03
SHA512 d3b0ee8e6499346984eff17b40810a40f58be224fa89e66e112ed86b458a798a47a1107c400548d80edd8dcdd9863263a5e78a9a5965dd30ed12a5a17c79d521
SSDEEP 24576:Ap9X1FMDJmd+PkJSh6I5KrDBWxOKduevOjB4YdfjlZW17TPV4UMH:ApN1yDJmd+PkJSh6I56gxOKduevOjB4W
TLSH
T1FF75F627A66864DDC1BBC078C2839F26B92130C90B356FF745D1827A2E25EF96E3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_5bfa27d1a0ab0c9efb37703cb117c4df_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-20_5bfa27d1a0ab0c9efb37703cb117c4df_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.5MB

2026-10-20_5bfa27d1a0ab0c9efb37703cb117c4df_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 17ce02653458a00a04f90c3244dccb5e
SHA256 3f20c4ab13e97970358b361ffcadb6b797b656be5d6555a995dd1b104e311d63
MD5 5bfa27d1a0ab0c9efb37703cb117c4df
SHA1 f7d0daa89c2264a9c8e2610dece639d2a428fb03
SHA512 d3b0ee8e6499346984eff17b40810a40f58be224fa89e66e112ed86b458a798a47a1107c400548d80edd8dcdd9863263a5e78a9a5965dd30ed12a5a17c79d521
SSDEEP 24576:Ap9X1FMDJmd+PkJSh6I5KrDBWxOKduevOjB4YdfjlZW17TPV4UMH:ApN1yDJmd+PkJSh6I56gxOKduevOjB4W
TLSH
T1FF75F627A66864DDC1BBC078C2839F26B92130C90B356FF745D1827A2E25EF96E3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1088024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-c25c48f83d2fbc39.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

GetCurrentThreadId CloseHandle LoadLibraryA GetProcAddress GetNativeSystemInfo FreeEnvironmentStringsW CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW FlushFileBuffers SetFileInformationByHandle GetCurrentProcess DuplicateHandle SetFilePointerEx WaitForSingleObject GetStdHandle GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess GetProcessHeap HeapFree FindFirstFileExW FindClose GetSystemTimeAsFileTime CreateHardLinkW CopyFileExW HeapReAlloc lstrlenW ReleaseMutex CreateEventW ReadFile GetOverlappedResult CancelIo GetModuleHandleW FormatMessageW GetModuleFileNameW ExitProcess ReadFileEx WaitForMultipleObjects CreateThread GetFullPathNameW GetModuleHandleA GetTempPathW HeapAlloc SetEnvironmentVariableW FindNextFileW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW DeleteFileW GetConsoleMode GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetConsoleOutputCP MultiByteToWideChar WideCharToMultiByte WaitForSingleObjectEx CreateMutexA InitializeSListHead SetUnhandledExceptionFilter WriteConsoleW

advapi32

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegQueryValueExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysStringLen SysFreeString

ntdll

NtOpenFile RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile NtReadFile

vcruntime140

__C_specific_handler __current_exception memcmp memmove memset memcpy __CxxFrameHandler3 __current_exception_context _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_set_app_type _crt_atexit _configure_narrow_argv terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _seh_filter_exe _initialize_narrow_environment _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_5bfa27d1a0ab0c9efb37703cb117c4df_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic