2026-10-23_94c3b80948014668fd8972ad0b6b11ef_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_94c3b80948014668fd8972ad0b6b11ef_akira_cobalt-strike_rusty-stealer_satacom
Size 20.6MB
Sample261023-llgpaaay81
SHA256 98cb534ae55407eb587adf650ffb1f5b575922625a2ddb8e8cd251331e675050
MD5 94c3b80948014668fd8972ad0b6b11ef
SHA1 6494eb2b157acb3e54434ca4345b86500f8656d5
SHA512 89e22afc0e7f44f62e5ecb4237b754d710d94ad631075a68b04f3fd359afa51bc5a009bbe2ac21f21b9aca81ff3df8bca90d62750ab6d326d69a52aba18bf9bc
SSDEEP 98304:0vVIedVXc4E71os3yBwB6skwh4/H23elB7UcGXE1h7S7+nzYm7iKGmQSS5OXtCIQ:5eXo1xCURkwhXOfUaA3mRoB
TLSH
T11827C4256679649DD2BAC0B8D2878F22AE2170DD07393FF745D082762F24EF8A93C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_94c3b80948014668fd8972ad0b6b11ef_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-23_94c3b80948014668fd8972ad0b6b11ef_akira_cobalt-strike_rusty-stealer_satacom

.exe 20.6MB

2026-10-23_94c3b80948014668fd8972ad0b6b11ef_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH a495efe036475395fcddcd82d83f190a
SHA256 98cb534ae55407eb587adf650ffb1f5b575922625a2ddb8e8cd251331e675050
MD5 94c3b80948014668fd8972ad0b6b11ef
SHA1 6494eb2b157acb3e54434ca4345b86500f8656d5
SHA512 89e22afc0e7f44f62e5ecb4237b754d710d94ad631075a68b04f3fd359afa51bc5a009bbe2ac21f21b9aca81ff3df8bca90d62750ab6d326d69a52aba18bf9bc
SSDEEP 98304:0vVIedVXc4E71os3yBwB6skwh4/H23elB7UcGXE1h7S7+nzYm7iKGmQSS5OXtCIQ:5eXo1xCURkwhXOfUaA3mRoB
TLSH
T11827C4256679649DD2BAC0B8D2878F22AE2170DD07393FF745D082762F24EF8A93C754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16520236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

syncliva_folders-4eff149ebdafd40a.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation PostQueuedCompletionStatus MoveFileExW UnlockFile GetOverlappedResult LockFileEx CreateEventW GetFileInformationByHandleEx GetQueuedCompletionStatusEx GetConsoleMode GetFileInformationByHandle CreateSemaphoreW CreateFileW WaitForSingleObjectEx ReleaseSemaphore ReadDirectoryChangesW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle CloseHandle ReadFile SetFileInformationByHandle GetCurrentProcess DuplicateHandle WriteConsoleW GetFileType GetSystemTimeAsFileTime InitializeSListHead DeviceIoControl GetFullPathNameW GetFinalPathNameByHandleW SetFileTime SetLastError CancelIo GetLastError FindNextFileW RtlLookupFunctionEntry RtlCaptureContext TerminateProcess GetExitCodeProcess GetSystemInfo GetCurrentThreadId QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW SleepEx ReadFileEx WaitForMultipleObjects CreateThread Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP MultiByteToWideChar HeapAlloc ExitProcess GetModuleFileNameW GetTempPathW FormatMessageW GetModuleHandleW CreateHardLinkW FindClose FindFirstFileExW DeleteFileW SwitchToThread CreateDirectoryW SetUnhandledExceptionFilter RemoveDirectoryW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject FlushFileBuffers SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WideCharToMultiByte lstrlenW HeapReAlloc HeapFree GetProcessHeap GetProcAddress GetModuleHandleA QueryPerformanceFrequency RtlVirtualUnwind

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtSetInformationFile NtReadFile

ws2_32

closesocket getsockopt setsockopt getpeername getsockname ioctlsocket WSAIoctl getaddrinfo recv send accept listen WSASocketW connect shutdown WSAGetLastError WSAStartup WSACleanup freeaddrinfo bind WSASend

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

memmove memset __CxxFrameHandler3 memcpy memcmp _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

pow floor __setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _configure_narrow_argv exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _initterm_e _set_app_type terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_94c3b80948014668fd8972ad0b6b11ef_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

bcrypt

advapi32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic