2026-10-22_fc389cef4864d6eeb8199eb8481639a5_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_fc389cef4864d6eeb8199eb8481639a5_akira_cobalt-strike_rusty-stealer_satacom
Size 5.9MB
Sample261023-at1atagy6z
SHA256 43de13c736fdc10a2a8a70753c023be581a828e4d7135159faad8141f06aea65
MD5 fc389cef4864d6eeb8199eb8481639a5
SHA1 d98d05f799cd22a36b25be84df03df9fb81b7e13
SHA512 3a312e4af00d5ec95ec7b64f8e234b3b9f1f95ca2b3631e36065c121593b7938ec3c799a401fb5c3c9ded0ae6e7d3632554d18bebe47736771fa76bc56bbe181
SSDEEP 49152:Qj76bD80GTqLVoa03TDHfCjZWKiBj9U3mKeqn/Z2cNXamaa4/0hOw82RGJ6Zaoaj:iFL7jsyRpwQ
TLSH
T1C756B42676BD509DD1BAC0B882879F22A92170CD07397BF749D182762F25EF8AD3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_fc389cef4864d6eeb8199eb8481639a5_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-22_fc389cef4864d6eeb8199eb8481639a5_akira_cobalt-strike_rusty-stealer_satacom

.exe 5.9MB

2026-10-22_fc389cef4864d6eeb8199eb8481639a5_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH a662b05d50b5733adaafc3d42688dd25
SHA256 43de13c736fdc10a2a8a70753c023be581a828e4d7135159faad8141f06aea65
MD5 fc389cef4864d6eeb8199eb8481639a5
SHA1 d98d05f799cd22a36b25be84df03df9fb81b7e13
SHA512 3a312e4af00d5ec95ec7b64f8e234b3b9f1f95ca2b3631e36065c121593b7938ec3c799a401fb5c3c9ded0ae6e7d3632554d18bebe47736771fa76bc56bbe181
SSDEEP 49152:Qj76bD80GTqLVoa03TDHfCjZWKiBj9U3mKeqn/Z2cNXamaa4/0hOw82RGJ6Zaoaj:iFL7jsyRpwQ
TLSH
T1C756B42676BD509DD1BAC0B882879F22A92170CD07397BF749D182762F25EF8AD3C354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4748352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

small_files.pdb

bcryptprimitives

ProcessPrng

kernel32

DeviceIoControl GetFullPathNameW GetFinalPathNameByHandleW SetFileTime CloseHandle GetFileInformationByHandleEx SetLastError CreateFileW GetLastError GetFileType UnlockFile GetFileInformationByHandle LockFileEx DuplicateHandle SetFileInformationByHandle SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime FindNextFileW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId QueryPerformanceCounter GetConsoleOutputCP GetCurrentProcess GetStdHandle GetConsoleMode WriteConsoleW QueryPerformanceFrequency GetModuleHandleA GetProcAddress CreateEventW GetOverlappedResult GetProcessHeap HeapFree HeapReAlloc lstrlenW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx FlushFileBuffers WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW CreateDirectoryW SwitchToThread DeleteFileW FindFirstFileExW FindClose GetModuleHandleW FormatMessageW GetTempPathW GetModuleFileNameW HeapAlloc MultiByteToWideChar

ntdll

RtlNtStatusToDosError NtSetInformationFile NtCreateFile NtOpenFile NtReadFile NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

vcruntime140

__current_exception_context __current_exception __CxxFrameHandler3 memmove memset memcmp _CxxThrowException __C_specific_handler memcpy

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv _register_onexit_function _c_exit _register_thread_local_exe_atexit_callback _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _crt_atexit terminate _initialize_onexit_table __p___argc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_fc389cef4864d6eeb8199eb8481639a5_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic