2026-10-28_a5a74abf6e842a5ff12cc24187b98e45_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_a5a74abf6e842a5ff12cc24187b98e45_akira_cobalt-strike_rusty-stealer_satacom
Size 1.8MB
Sample261029-1peresce75
SHA256 86da62f2301298fb96f0b95fe9734599af506c79fad513b1b2b38551ebb1e439
MD5 a5a74abf6e842a5ff12cc24187b98e45
SHA1 871e9db009f62108c99ae995a9eb01b0ea520ee4
SHA512 2bc8d5285d8309841047a9169282ae3a54910665aef622c9bd5129ac9aa1084002f4478bd30077d33737bf23a8aded1576858d936a301a153a919304fd2c5610
SSDEEP 49152:N8OVocCYEFB7ieeLwlPCXPAQO6t7hcvu+:HbE
TLSH
T1A895F926B77865D9C1BBC078C2839F21B92170D90B352FFB459182B92E25EF86E7D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_a5a74abf6e842a5ff12cc24187b98e45_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-28_a5a74abf6e842a5ff12cc24187b98e45_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.8MB

2026-10-28_a5a74abf6e842a5ff12cc24187b98e45_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 6099d542c640c38cb07ef03c77f598eb
SHA256 86da62f2301298fb96f0b95fe9734599af506c79fad513b1b2b38551ebb1e439
MD5 a5a74abf6e842a5ff12cc24187b98e45
SHA1 871e9db009f62108c99ae995a9eb01b0ea520ee4
SHA512 2bc8d5285d8309841047a9169282ae3a54910665aef622c9bd5129ac9aa1084002f4478bd30077d33737bf23a8aded1576858d936a301a153a919304fd2c5610
SSDEEP 49152:N8OVocCYEFB7ieeLwlPCXPAQO6t7hcvu+:HbE
TLSH
T1A895F926B77865D9C1BBC078C2839F21B92170D90B352FFB459182B92E25EF86E7D314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1311440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-3560b57ec9293223.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

CloseHandle GetProcAddress LoadLibraryA GetNativeSystemInfo PeekNamedPipe CreateEventA WaitForMultipleObjects WaitForSingleObject OpenSemaphoreA ReleaseSemaphore SetEvent GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW CopyFileExW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CreateFileW InitializeSListHead GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose CreateHardLinkW GetConsoleMode GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx ReadFile QueryPerformanceFrequency CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetExitCodeProcess IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW TerminateProcess

advapi32

RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW

ole32

CoInitializeEx CoCreateInstance

oleaut32

SysStringLen SysFreeString

ntdll

RtlNtStatusToDosError NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile

vcruntime140

memcpy __current_exception_context __current_exception __C_specific_handler memcmp memset _CxxThrowException __CxxFrameHandler3 memmove

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _set_app_type _seh_filter_exe _initterm _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_a5a74abf6e842a5ff12cc24187b98e45_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic