a9bd71d685db522112504ff9a306b3d415428d760bc27752657e5e69b6d22aba

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 15.3MB
Sample261024-e1slrssvcs
SHA256 a9bd71d685db522112504ff9a306b3d415428d760bc27752657e5e69b6d22aba
MD5 93a5521906200addc99e9e65c0f2e5e1
SHA1 20445f0a936af0d73a2624ff9fd83993fc62d7f4
SHA512 a31de7010f153f65913e9eecb76f533fd4bb96b59ded521af8f04864b6edabb221a0206e452b52ba94d9ecd51ea09aa5c549b8049259eef398e900d48496a16c
SSDEEP 98304:BSSFXTJU0pMbJQrQOGPqv+7t8K+V5EdXuo+IBRS8IYpM9dnCmA:BdV1pMbJOQOGnJ72+vq1CmA
TLSH
T153F6A526667960DDC1BBC0B882879F62AD2170DD07393BF745D1827A2F24EF8A93C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4388	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 4388	5748	2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Windows\system32\cmd.exe
  "cmd.exe" /d /c mklink /J C:\Users\Admin\AppData\Local\Temp\.tmpJ6OZAE\alias C:\Users\Admin\AppData\Local\Temp\.tmpJ6OZAE\old
  2⤵
  - Executes a command shell one-liner
  PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmp1breS1\.syncliva-root
Size 146B
SHA256 861741a335fbc8c1a77ecb46d3fced6a3e82a843346cc2b6182743cd398572af
MD5 8b6d7ca734d56a78816f42b563aac32c
SHA1 a2334f7997078e99a0dd40d3952e12acea5256cb
SHA512 724cc7259b381d9e62cf6a0782b72fd2f0ea2361785e182fee58f7ce5f1a5edf861342997d1768a2fe4ea5b67341e382cc15b698690feb0d9fca93248be417c2
TLSH
T1CBC08010F03194304676681ED294593784595A8B40A25C51701945DE11718E82454410
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmp7yWARd\.syncliva-root
Size 146B
SHA256 72286f821ebc3d085dd096726557e04663fe1407c0c598e00491cd14a53c7ce8
MD5 7ec70820a072a1e8deebcfcbcb264c80
SHA1 53c2520434ff41960836073c77651e778d2a8cab
SHA512 d961b71a8ba42b022d2755022f6ceb225d1433cdea3eb4fa4be11679c52a81fdd04313be311f63e3bd892e0ead87aaaa534b91dca58c48b564060443c375d487
TLSH
T172C02B6FA1CE946BA0D003030D1B8A43FAF5EF98411211AFF14364D522A7061A5D2401
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpEwVv7r\.syncliva-root
Size 146B
SHA256 53065ebbeaeecb7ec229067cbb7450210fc8dade6991e9eff20ddc6ed94e9dfd
MD5 a93e894a22f527c523af81900fb87597
SHA1 e3ff05a134e3d33ea4ee599c3546aea57ad4d944
SHA512 d5f77aa67caee808cd34b20b3439046ec525c865fde0d78ef7d8e2b0a7f1ecb19db54e361491766b008be38c09b76bc20106bb970186d360ba0765c2343a0f4d
TLSH
T1E3C08C39A85A21A05022092959419A50AC7C26F2EBCD066B3B4E00E5056BD51AF9020A
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpIsu5jt\.syncliva-root
Size 146B
SHA256 e2e0bf9b9651c406badfad996cabe96d35c8eb1b21bb6ca3014aee1c07693100
MD5 ccbcd37a47f1924b05f645f244d1b17f
SHA1 8a9ef16561d6fa9a797ca3e98bbead31d38845ee
SHA512 5359ddeb047e235a4c63ef8a274911fad5d374d19f1be5df051242a149f37c9803d1dc390337912ec5bf91a0a8f27221a7457b790912165a3f38799ff49d1e57
TLSH
T161C08CD0A05D142C204518AADCE000221918E5FD4D94667639A9B16097AB2944A4802B
MD5 SHA1 SHA512 TLSH

Submit Download

notes

Path C:\Users\Admin\AppData\Local\Temp\.tmpIsu5jt\notes
Size 3B
SHA256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
MD5 900150983cd24fb0d6963f7d28e17f72
SHA1 a9993e364706816aba3e25717850c26c9cd0d89d
SHA512 ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
MD5 SHA1 SHA512

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpJ6OZAE\old\root\.syncliva-root
Size 146B
SHA256 9eaf0ae3b2080a96e80c8066e684d677e0d05cc2133f7ce1c76be109fe5aab32
MD5 31bbd79c0212009ed28eac71bf87f471
SHA1 c4a1f16bdf977bc771a1a4b89a6aa19e38454437
SHA512 561a8e5f726cdb22241f02a47ffcfba4d09849b2d3b5617b14eb790a0edd6d58a328da680b8defaf737a8b35f67c5079d9d59ca03377acf0485ef5bf46903cab
TLSH
T19DC08CBA8A10143429D45C06E5A221E12030E4AF89563CAB22EB54841164FA23E40840
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpMRn9kI\.syncliva-root
Size 146B
SHA256 c2a24feac34577937f95b0255ad13e1c8d020fe7505d066040813afd7c491442
MD5 41d0fdd022d4c7e4d6362dbd24e4186e
SHA1 e541d528c1ebc95934ef5a056d386a62286b7253
SHA512 6dafab737b6d5614e79b2e0ff3d5069bbcdbf3db9c40879f9a171cb6de5a372ae1a58fa0323171f58b12bf0b0e68d8a13d3eadd77f7ed356e503330478dc6f1e
TLSH
T175C08C793CC00B30819416E8EE1852E862A124C10C3F2A28B5F596902F00CD424E14A2
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpQICUJm\.syncliva-root
Size 146B
SHA256 5b9f95889ff9a09f5002aa57ca4afa1ab7f2da55c66014fc58a5b2d0cd595449
MD5 8ab5a30e052e5819b9604c788de95d8d
SHA1 5c797caca70d09d42eb7560b1386ea91a3a89406
SHA512 2de94e4b32918599047aafd20b2d9d74f92378479bfcb2191875def911a55e3a39c0921c00ff9db3405d05fd303c73533c42b9aaf16dacec0faf2174df581f44
TLSH
T1DAC02BF23220DBB044531496196956494DF0316008C737A5E2C8668133591975008840
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpbOpxOI\.syncliva-root
Size 146B
SHA256 07ae2f8c55ff5b72fc28b01bef398ed94ccab537b12396db9351daab47a89e66
MD5 768ab4fc1168cd440c64d42b7f30ec54
SHA1 f90dd4bf4586f0672951246278a9bc6870f7e0fb
SHA512 0082958e36868be42b94ccdd0fa3dba56c805c57b43c1929e25151eb9f49a66428043478340c1e0cf17a9eb62428ac7ad846d5ef598baa2031160da148fdac1c
TLSH
T103C02B53CE1000F2430E61498CEC385152D474B109243E3D630A07671B966394C05C46
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpcUPBkp\.syncliva-root
Size 146B
SHA256 afa3732ae66663f226bf71b693f413d22725f441255422f9672413bcdee2f3fe
MD5 2b4d40cf8910bdd413e052217f659995
SHA1 a0a1dd464fb0cd2037efa33b4392f5dc023dd0b2
SHA512 f150269cdeb4a9256b4c8c5ef6e6b11b98f69e6cabb3371311d3b777881ab726f2070780c0e6fddc6f99da5943789aab9562a9b1dd0b367c80ea7f7bfa871edc
TLSH
T115C02B1286B881FCE0B53947249193C1A3E32C2404D8001D784E5D1F3D06606CBC2501
MD5 SHA1 SHA512 TLSH

Submit Download

registry.redb

Path C:\Users\Admin\AppData\Local\Temp\.tmppquS9m\folders\registry.redb
Size 52KB
SHA256 132c9c6bf7bc4330c49d31d99199a3498c84ee1dd2ace6ecdbb6c25fcc403711
MD5 620093b2fb3f5b36626de5a54fcb829a
SHA1 f61a1ce03b655a02d5332880cbdd70e73ad91f77
SHA512 541fd5b62d04b5e174390767a7f429fdf01759974d850ff6cae98c6c5f8979390cc06fe3737c38c1d598d60a0640697e59ae034370890a0ab2e1bf89ac020da0
SSDEEP 96:B5yV/pj3CAAAAAAAAAAAAAAAAAAAARAAAAAAAAAAAAAAAAAAAAgb/pvD:B5kpThpvD
TLSH
T1C633E551B300C75BD587133AEE5BCB829B92FD809E65C64B3101B31C7DB2FEE8862624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmpqRjSeW\.syncliva-root
Size 146B
SHA256 131c7d4e1b745dcb945c0be5ea86e44ea4dd2d9cc60db69970e1cb41b6b2190e
MD5 7d573c99575bb78cb592374e7f0d949b
SHA1 88283494e62bc8b8d1f5c1895e007be8099ad4c1
SHA512 7f2f4596175f4c9069e227dd30b0800b116fb393c841c094d307e862bc159ed1567f524a7a77a5fc9bf29e181266a481b83b8508accfc16680dcf9fc0ce39e3e
TLSH
T1BDC02B3C0274D233C06030FA14D5418CF440455FB731389623C6A3930603C700006000
MD5 SHA1 SHA512 TLSH

Submit Download

.syncliva-root

Path C:\Users\Admin\AppData\Local\Temp\.tmptWTnGe\.syncliva-root
Size 146B
SHA256 726790a94a96686511278334ec9860aa0c837b94ab5467115d1d712cf58eb43a
MD5 fc7d799ca5465645a0f9177dd68e7d68
SHA1 d488e938589fbd278382e42701c3ed4107de27fb
SHA512 fe76093c494a94b366f3dfc018a9dd6dd3a9977eac51fd672e853d4f5085d763a7ea9bc7c5c76b488afdcb97241db299e61915958b03f9e78874d60754e0af8e
TLSH
T119C02B50859832F8C807494DFDA0AC6F8430FBD4040F23F6231130113C77CF58296858
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads