2026-10-30_8a4ecdfc1e93dd64975b3ec7b10d727e_akira_cobalt-strike_quasar-rat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_8a4ecdfc1e93dd64975b3ec7b10d727e_akira_cobalt-strike_quasar-rat_satacom
Size 1.6MB
Sample261030-2rn9basz6n
SHA256 2d99c997a704243b6756de6970e716797aef49f59df6291bfe49a38ef5c30b37
MD5 8a4ecdfc1e93dd64975b3ec7b10d727e
SHA1 421f492c14d643daf0936b5d027bb035cd4a9eef
SHA512 ae5e0ecaa6802c2272a229694eac704cac59705d3dcbfa0d51c61a66dc423456d9e2a1ae4e3fe23d53ecdf3b13198f75187bcf7a7df23b170015436b8cceb002
SSDEEP 49152:4YLD6JIqRG6HgAaveYst5SW6H8DS52tdDpbRZy:FD720vef5SSDntdDpbRZy
TLSH
T12E759D2AF64161E9E02DC1B58B764532FA38B5CA073079FF068453752E75EE06F3DA88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_8a4ecdfc1e93dd64975b3ec7b10d727e_akira_cobalt-strike_quasar-rat_satacom

File Explorer

2026-10-30_8a4ecdfc1e93dd64975b3ec7b10d727e_akira_cobalt-strike_quasar-rat_satacom

.exe 1.6MB

2026-10-30_8a4ecdfc1e93dd64975b3ec7b10d727e_akira_cobalt-strike_quasar-rat_satacom

IMPHASH 16d6334dedab1ca30f45f7002d318744
SHA256 2d99c997a704243b6756de6970e716797aef49f59df6291bfe49a38ef5c30b37
MD5 8a4ecdfc1e93dd64975b3ec7b10d727e
SHA1 421f492c14d643daf0936b5d027bb035cd4a9eef
SHA512 ae5e0ecaa6802c2272a229694eac704cac59705d3dcbfa0d51c61a66dc423456d9e2a1ae4e3fe23d53ecdf3b13198f75187bcf7a7df23b170015436b8cceb002
SSDEEP 49152:4YLD6JIqRG6HgAaveYst5SW6H8DS52tdDpbRZy:FD720vef5SSDntdDpbRZy
TLSH
T12E759D2AF64161E9E02DC1B58B764532FA38B5CA073079FF068453752E75EE06F3DA88
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

810200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gpu_memory_check.pdb

bcryptprimitives

ProcessPrng

kernel32

GetProcessHeap HeapFree FormatMessageW CreateFileMappingA SetHandleInformation OpenProcess GetModuleFileNameW FreeLibrary SetNamedPipeHandleState PeekNamedPipe WriteFile LoadLibraryExW ReadFile CreateNamedPipeA ConnectNamedPipe GetTimeZoneInformationForYear SetThreadErrorMode LocalFree GetSystemTimeAsFileTime FreeEnvironmentStringsW DeleteProcThreadAttributeList AddVectoredExceptionHandler SetThreadStackGuarantee CreateWaitableTimerExW Sleep QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetFileInformationByHandle SetUnhandledExceptionFilter GetCurrentThread GetLastError GetProcAddress GetNativeSystemInfo GetCurrentThreadId GetStdHandle GetCurrentProcessId CreateMutexA WriteFileEx SleepEx GetProcessId GetSystemTimePreciseAsFileTime CreateEventA HeapReAlloc lstrlenW HeapAlloc CreateFileW ResetEvent ReleaseMutex WaitForSingleObject GetConsoleMode DuplicateHandle GetCurrentProcess SetEvent GetModuleHandleW ExitProcess CreateNamedPipeW ReadFileEx GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread InitializeSListHead UnmapViewOfFile MapViewOfFile WaitForSingleObjectEx LoadLibraryA CloseHandle SetWaitableTimer GetModuleHandleA CompareStringOrdinal

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

advapi32

SetSecurityDescriptorDacl MakeSelfRelativeSD GetTokenInformation OpenProcessToken InitializeSecurityDescriptor SetEntriesInAclA

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

memmove __CxxFrameHandler3 __C_specific_handler memcmp __current_exception __current_exception_context memcpy memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e _c_exit _register_onexit_function _initterm _get_initial_narrow_environment _initialize_narrow_environment terminate _configure_narrow_argv _cexit __p___argv __p___argc _crt_atexit _exit _initialize_onexit_table _set_app_type _seh_filter_exe exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Name

.text

Size

813KB

Virtual Size

813KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_8a4ecdfc1e93dd64975b3ec7b10d727e_akira_cobalt-strike_quasar-rat_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic