2026-10-21_a2027095859ee99be9e5ec9dbc79f2f8_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_a2027095859ee99be9e5ec9dbc79f2f8_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom
Size 4.1MB
Sample261022-sd7dasds5s
SHA256 e1a7008369c2fa4a0288c352662b08a68c11d435b51b2d686ca56f54676d8037
MD5 a2027095859ee99be9e5ec9dbc79f2f8
SHA1 ad038d075e6fe697e02c4c35b3923e3cc917f555
SHA512 08eafc5f443749c2fadf3e7075f9745f60f2ca84ec8cd1cfe29942db76573d538c0f9c0022ea5b3e08d048c431c901d8362c4eb8ea568ec6f38abbb4a493697d
SSDEEP 49152:C6UsbW9K7vM4lRXD2kO986M4/ACgehwnfNWYbyceiWKAIU6iEjSYszRhw:CR9I7n+XiWK/+sSYszRhw
TLSH
T15F163957B4C6BED8CC16C070829BCB121D617C960B6167E737C0832F2EAB7E67E65A05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_a2027095859ee99be9e5ec9dbc79f2f8_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

File Explorer

2026-10-21_a2027095859ee99be9e5ec9dbc79f2f8_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

.exe 4.1MB

2026-10-21_a2027095859ee99be9e5ec9dbc79f2f8_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

IMPHASH 24c89410752f9ce84542f502742c0737
SHA256 e1a7008369c2fa4a0288c352662b08a68c11d435b51b2d686ca56f54676d8037
MD5 a2027095859ee99be9e5ec9dbc79f2f8
SHA1 ad038d075e6fe697e02c4c35b3923e3cc917f555
SHA512 08eafc5f443749c2fadf3e7075f9745f60f2ca84ec8cd1cfe29942db76573d538c0f9c0022ea5b3e08d048c431c901d8362c4eb8ea568ec6f38abbb4a493697d
SSDEEP 49152:C6UsbW9K7vM4lRXD2kO986M4/ACgehwnfNWYbyceiWKAIU6iEjSYszRhw:CR9I7n+XiWK/+sSYszRhw
TLSH
T15F163957B4C6BED8CC16C070829BCB121D617C960B6167E737C0832F2EAB7E67E65A05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2176176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

b2_backtest.pdb

bcryptprimitives

ProcessPrng

kernel32

GetConsoleScreenBufferInfo GetSystemInfo GetCurrentProcessorNumber TlsFree TlsSetValue TlsAlloc SwitchToThread GetCurrentProcess GetProcessTimes Sleep AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock CloseHandle WriteFile GetStdHandle GetFileInformationByHandleEx GetProcAddress FreeLibrary GetLastError SetFileInformationByHandle DuplicateHandle GetFileInformationByHandle SetLastError WaitForSingleObject GetCurrentThread GetCurrentThreadId CreateThread GetCurrentProcessId FindClose CreateFileW GetSystemTimeAsFileTime WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar FormatMessageW GetModuleHandleW GetModuleHandleA GetFullPathNameW GetConsoleMode FindFirstFileExW CreateDirectoryW RtlCaptureContext GetEnvironmentVariableW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte lstrlenW SetUnhandledExceptionFilter RtlVirtualUnwind LoadLibraryW MapViewOfFile CreateFileMappingW UnmapViewOfFile LoadLibraryA GetModuleHandleExA VirtualQuery VirtualFree VirtualProtect VirtualAlloc QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentVariableA RtlLookupFunctionEntry InitializeSListHead

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueA

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

vcruntime140

memset __current_exception memmove _CxxThrowException __CxxFrameHandler3 __current_exception_context memcmp __C_specific_handler memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

log10 log pow round exp logf ceil roundf __setusermatherr floor log2 exp2

api-ms-win-crt-runtime-l1-1-0

_initterm _set_app_type _errno _initterm_e _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe _get_initial_narrow_environment exit _exit __p___argc __p___argv _cexit terminate _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

fputs __acrt_iob_func __p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_a2027095859ee99be9e5ec9dbc79f2f8_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

bcryptprimitives

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic