2026-10-22_36d097ad1012594a8903c9dd9f20a115_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_36d097ad1012594a8903c9dd9f20a115_akira_cobalt-strike_rusty-stealer_satacom
Size 16.8MB
Sample261024-t9qabsfc82
SHA256 7c77c44c2677f122932dc7a633b63f7fb454c40d49bbea7b6733645f8828d1a2
MD5 36d097ad1012594a8903c9dd9f20a115
SHA1 6ee2e3bb454f703bc4a8325e57bd8a70b7615e14
SHA512 514eac95124129bcad40a4d10bf11e7f7cd1c5a38b4c5abf717721c2f0332da82910c916b5990dbb989340cec9b7c80716a6aa22fed3551afd50ae93788fac05
SSDEEP 98304:Y1DBxa0nt2Jv46By+f59dvdABh9t7AJv+Gq2WDJ6M2b4zXnyveNzSNi:GzqJv46By+f1vdAnmJuNzSN
TLSH
T16707B5266679609DD1BAC0B8D2878F62AD2170CD07393BF745D1827A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_36d097ad1012594a8903c9dd9f20a115_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-22_36d097ad1012594a8903c9dd9f20a115_akira_cobalt-strike_rusty-stealer_satacom

.exe 16.8MB

2026-10-22_36d097ad1012594a8903c9dd9f20a115_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 472c6ec6554d91b0b78e84ec7807b5cb
SHA256 7c77c44c2677f122932dc7a633b63f7fb454c40d49bbea7b6733645f8828d1a2
MD5 36d097ad1012594a8903c9dd9f20a115
SHA1 6ee2e3bb454f703bc4a8325e57bd8a70b7615e14
SHA512 514eac95124129bcad40a4d10bf11e7f7cd1c5a38b4c5abf717721c2f0332da82910c916b5990dbb989340cec9b7c80716a6aa22fed3551afd50ae93788fac05
SSDEEP 98304:Y1DBxa0nt2Jv46By+f59dvdABh9t7AJv+Gq2WDJ6M2b4zXnyveNzSNi:GzqJv46By+f1vdAnmJuNzSN
TLSH
T16707B5266679609DD1BAC0B8D2878F62AD2170CD07393BF745D1827A2F24EF8AD3C754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13374620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

automation-07650fe039c3d3ac.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

SetFileCompletionNotificationModes CreateIoCompletionPort PostQueuedCompletionStatus SetHandleInformation UnlockFile GetOverlappedResult LockFileEx CreateEventW GetFileInformationByHandleEx GetQueuedCompletionStatusEx GetConsoleMode GetFileInformationByHandle CreateSemaphoreW CreateFileW WaitForSingleObjectEx ReleaseSemaphore ReadDirectoryChangesW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle CloseHandle ReadFile SetFileInformationByHandle GetCurrentProcess DuplicateHandle WriteConsoleW GetFileType GetSystemTimeAsFileTime InitializeSListHead DeviceIoControl GetFullPathNameW GetFinalPathNameByHandleW SetFileTime SetLastError CancelIo GetLastError FindNextFileW RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess GetSystemInfo GetCurrentThreadId QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetFileAttributesW SleepEx ReadFileEx WaitForMultipleObjects CreateThread Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP MultiByteToWideChar HeapAlloc ExitProcess GetModuleFileNameW GetTempPathW FormatMessageW GetModuleHandleW CreateHardLinkW FindClose FindFirstFileExW DeleteFileW SwitchToThread CreateDirectoryW SetUnhandledExceptionFilter RemoveDirectoryW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject FlushFileBuffers SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WideCharToMultiByte lstrlenW HeapReAlloc HeapFree GetProcessHeap GetProcAddress GetModuleHandleA QueryPerformanceFrequency RtlVirtualUnwind

ntdll

NtCancelIoFileEx NtDeviceIoControlFile NtWriteFile NtCreateFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtSetInformationFile NtReadFile

ws2_32

closesocket getsockopt setsockopt getsockname ioctlsocket WSAIoctl getaddrinfo recv send accept listen WSASocketW connect WSAGetLastError WSAStartup WSACleanup freeaddrinfo bind WSASend

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

memmove memset __CxxFrameHandler3 memcpy memcmp _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

pow floor __setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _configure_narrow_argv exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _initterm_e _set_app_type terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_36d097ad1012594a8903c9dd9f20a115_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

bcrypt

advapi32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic