2026-10-23_41f8f9b5fc914d33baf0f16a6cf576a3_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_41f8f9b5fc914d33baf0f16a6cf576a3_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom
Size 8.1MB
Sample261023-p74bysx1es
SHA256 b06bd28d58384261ef0640592f9d66b5543c0b3f530344a05eae7afb0a6904d2
MD5 41f8f9b5fc914d33baf0f16a6cf576a3
SHA1 1c19a2ecc25e22df8ecfa99e0a9d2d0cdb4ee80d
SHA512 4559683c4922784a3611c037926e772f6ecec2cdf7150485f80fe81b0ed06df044838d58e305a49e73ea43611bce864f64f582cb768e93719271c503edcf591e
SSDEEP 98304:qfMtqKDaWL76jIkyAarJsGd7rtM1iJZeBhl:q7KWu7mIkyAarJsGdugAl
TLSH
T1D786C416A67A51DCC5BAC0B892875E62BD7170D90B386BF745D1823A2F30EF8AD3D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_41f8f9b5fc914d33baf0f16a6cf576a3_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

File Explorer

2026-10-23_41f8f9b5fc914d33baf0f16a6cf576a3_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

.exe 8.1MB

2026-10-23_41f8f9b5fc914d33baf0f16a6cf576a3_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

IMPHASH 968622834cd8d0eadefbd87b1d1e6990
SHA256 b06bd28d58384261ef0640592f9d66b5543c0b3f530344a05eae7afb0a6904d2
MD5 41f8f9b5fc914d33baf0f16a6cf576a3
SHA1 1c19a2ecc25e22df8ecfa99e0a9d2d0cdb4ee80d
SHA512 4559683c4922784a3611c037926e772f6ecec2cdf7150485f80fe81b0ed06df044838d58e305a49e73ea43611bce864f64f582cb768e93719271c503edcf591e
SSDEEP 98304:qfMtqKDaWL76jIkyAarJsGd7rtM1iJZeBhl:q7KWu7mIkyAarJsGdugAl
TLSH
T1D786C416A67A51DCC5BAC0B892875E62BD7170D90B386BF745D1823A2F30EF8AD3D344
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6505100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

netmonitor_history_store-e0257bcc328d820f.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

GetFileInformationByHandle CloseHandle MoveFileExW ReadFileEx InitializeSListHead CreateMutexA WriteConsoleW GetConsoleOutputCP CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileType GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary GetModuleHandleW SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId FreeEnvironmentStringsW CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetFileInformationByHandle GetCurrentProcess DuplicateHandle SetFilePointerEx WriteFileEx SleepEx GetExitCodeProcess QueryPerformanceFrequency GetSystemTimePreciseAsFileTime FindFirstFileExW FindClose CreateHardLinkW CopyFileExW lstrlenW ReleaseMutex CreateEventW GetOverlappedResult CancelIo GetModuleFileNameW ExitProcess SetUnhandledExceptionFilter WaitForMultipleObjects CreateThread CreateWaitableTimerExW SetWaitableTimer GetModuleHandleA FindNextFileW GetFileInformationByHandleEx CreateDirectoryW CreateSymbolicLinkW GetFinalPathNameByHandleW GetConsoleMode

ntdll

NtOpenFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context __current_exception _CxxThrowException __CxxFrameHandler3 memcpy __C_specific_handler strrchr strchr memchr memcmp memmove memset

api-ms-win-crt-string-l1-1-0

strcmp strspn strlen strcspn strncmp

api-ms-win-crt-math-l1-1-0

_dclass fabs fmod floor log __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _msize realloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _register_onexit_function _crt_atexit _beginthreadex _endthreadex _seh_filter_exe _set_app_type _initialize_narrow_environment _configure_narrow_argv _exit _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_41f8f9b5fc914d33baf0f16a6cf576a3_akira_cobalt-strike_quasar-rat_rusty-stealer_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

userenv

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic