2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom
Size 15.3MB
Sample261024-e1slrssvcs
SHA256 a9bd71d685db522112504ff9a306b3d415428d760bc27752657e5e69b6d22aba
MD5 93a5521906200addc99e9e65c0f2e5e1
SHA1 20445f0a936af0d73a2624ff9fd83993fc62d7f4
SHA512 a31de7010f153f65913e9eecb76f533fd4bb96b59ded521af8f04864b6edabb221a0206e452b52ba94d9ecd51ea09aa5c549b8049259eef398e900d48496a16c
SSDEEP 98304:BSSFXTJU0pMbJQrQOGPqv+7t8K+V5EdXuo+IBRS8IYpM9dnCmA:BdV1pMbJOQOGnJ72+vq1CmA
TLSH
T153F6A526667960DDC1BBC0B882879F62AD2170DD07393BF745D1827A2F24EF8A93C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom

.exe 15.3MB

2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH d91fccea4fcb13af3343390ab2268b11
SHA256 a9bd71d685db522112504ff9a306b3d415428d760bc27752657e5e69b6d22aba
MD5 93a5521906200addc99e9e65c0f2e5e1
SHA1 20445f0a936af0d73a2624ff9fd83993fc62d7f4
SHA512 a31de7010f153f65913e9eecb76f533fd4bb96b59ded521af8f04864b6edabb221a0206e452b52ba94d9ecd51ea09aa5c549b8049259eef398e900d48496a16c
SSDEEP 98304:BSSFXTJU0pMbJQrQOGPqv+7t8K+V5EdXuo+IBRS8IYpM9dnCmA:BdV1pMbJOQOGnJ72+vq1CmA
TLSH
T153F6A526667960DDC1BBC0B882879F62AD2170DD07393BF745D1827A2F24EF8A93C754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12185328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

folders-f1cc23728f822754.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation PostQueuedCompletionStatus MoveFileExW UnlockFile GetOverlappedResult LockFileEx CreateEventW GetFileInformationByHandleEx GetQueuedCompletionStatusEx GetConsoleMode GetFileInformationByHandle CreateSemaphoreW CreateFileW WaitForSingleObjectEx ReleaseSemaphore ReadDirectoryChangesW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle CloseHandle ReadFile SetFileInformationByHandle GetCurrentProcess DuplicateHandle WriteConsoleW GetFileType GetSystemTimeAsFileTime InitializeSListHead DeviceIoControl GetFullPathNameW GetFinalPathNameByHandleW SetFileTime SetLastError CancelIo GetLastError FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo GetCurrentThreadId QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW SleepEx ReadFileEx WaitForMultipleObjects CreateThread Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP MultiByteToWideChar HeapAlloc ExitProcess GetModuleFileNameW GetTempPathW FormatMessageW GetModuleHandleW CreateHardLinkW FindClose FindFirstFileExW DeleteFileW SwitchToThread CreateDirectoryW SetUnhandledExceptionFilter RemoveDirectoryW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject FlushFileBuffers SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WideCharToMultiByte lstrlenW HeapReAlloc HeapFree GetProcessHeap GetProcAddress GetModuleHandleA QueryPerformanceFrequency RtlVirtualUnwind

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtSetInformationFile NtReadFile

ws2_32

closesocket getsockopt setsockopt getsockname ioctlsocket WSAIoctl getaddrinfo recv send accept listen WSASocketW connect WSAGetLastError WSAStartup WSACleanup freeaddrinfo bind WSASend

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

memcmp memmove memcpy __CxxFrameHandler3 memset _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

pow floor __setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _configure_narrow_argv exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _initterm_e _set_app_type terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_93a5521906200addc99e9e65c0f2e5e1_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

bcrypt

advapi32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic