2026-10-22_68eac99a859074a07b611dbaff9095c2_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_68eac99a859074a07b611dbaff9095c2_akira_cobalt-strike_rusty-stealer_satacom
Size 15.2MB
Sample261024-l7lv5ahs4v
SHA256 2328f430faf3d158f259361414b54b8110bd5e45f1f98287bbbef8f7355ac8de
MD5 68eac99a859074a07b611dbaff9095c2
SHA1 413f346ab039d8d3b1ca8f951faebb1a094711ae
SHA512 eff62cd7829b07173194afec29d74ec85609ba3c342755ecb1c0cc635cca6ec2f882446bfb27e08768d3b3b843eccd5d2119466aa327a89a301408e5fc9dd90a
SSDEEP 98304:Jxm4ivBdFlf1K053MbqiRsG78xm+r1Il9+rGQo0SdcLtYOluovTSYsa:JxIjK058qi34QwFo7gu5z
TLSH
T16CF6B526667960DDC1BAC0B882879F62AD2170CD07397BF745D1827A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_68eac99a859074a07b611dbaff9095c2_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-22_68eac99a859074a07b611dbaff9095c2_akira_cobalt-strike_rusty-stealer_satacom

.exe 15.2MB

2026-10-22_68eac99a859074a07b611dbaff9095c2_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH a204b9a75317e45e1c3a25b7a275dba5
SHA256 2328f430faf3d158f259361414b54b8110bd5e45f1f98287bbbef8f7355ac8de
MD5 68eac99a859074a07b611dbaff9095c2
SHA1 413f346ab039d8d3b1ca8f951faebb1a094711ae
SHA512 eff62cd7829b07173194afec29d74ec85609ba3c342755ecb1c0cc635cca6ec2f882446bfb27e08768d3b3b843eccd5d2119466aa327a89a301408e5fc9dd90a
SSDEEP 98304:Jxm4ivBdFlf1K053MbqiRsG78xm+r1Il9+rGQo0SdcLtYOluovTSYsa:JxIjK058qi34QwFo7gu5z
TLSH
T16CF6B526667960DDC1BAC0B882879F62AD2170CD07397BF745D1827A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12152992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

local_scans-ff45db4e66ae3c0a.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

SetFileCompletionNotificationModes CreateIoCompletionPort SetHandleInformation PostQueuedCompletionStatus UnlockFile GetOverlappedResult LockFileEx CreateEventW GetFileInformationByHandleEx GetQueuedCompletionStatusEx GetConsoleMode GetFileInformationByHandle CreateSemaphoreW CreateFileW WaitForSingleObjectEx ReleaseSemaphore ReadDirectoryChangesW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle CloseHandle ReadFile SetFileInformationByHandle GetCurrentProcess DuplicateHandle WriteConsoleW GetFileType GetSystemTimeAsFileTime InitializeSListHead DeviceIoControl GetFullPathNameW GetFinalPathNameByHandleW SetFileTime SetLastError CancelIo GetLastError FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo GetCurrentThreadId QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW SleepEx ReadFileEx WaitForMultipleObjects CreateThread Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP MultiByteToWideChar HeapAlloc ExitProcess GetModuleFileNameW GetTempPathW FormatMessageW GetModuleHandleW CreateHardLinkW FindClose FindFirstFileExW DeleteFileW SwitchToThread CreateDirectoryW SetUnhandledExceptionFilter RemoveDirectoryW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject FlushFileBuffers SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WideCharToMultiByte lstrlenW HeapReAlloc HeapFree GetProcessHeap GetProcAddress GetModuleHandleA QueryPerformanceFrequency RtlVirtualUnwind

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtSetInformationFile NtReadFile

ws2_32

closesocket getsockopt setsockopt getsockname ioctlsocket WSAIoctl getaddrinfo recv send accept listen WSASocketW connect WSAGetLastError WSAStartup WSACleanup freeaddrinfo bind WSASend

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

memcmp memmove memcpy __CxxFrameHandler3 memset _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

pow floor __setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _configure_narrow_argv exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _initterm_e _set_app_type terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_68eac99a859074a07b611dbaff9095c2_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

bcrypt

advapi32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic