2026-10-28_782d481ee6614a7ced47d15c0ec09de1_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_782d481ee6614a7ced47d15c0ec09de1_akira_cobalt-strike_rusty-stealer_satacom
Size 1.6MB
Sample261030-b4fvlavvct
SHA256 3e1bb6a2875c06980c5ca0b124e19b99c68fdfdde64323edb648def196aee4a3
MD5 782d481ee6614a7ced47d15c0ec09de1
SHA1 9bd8643462a1a19f04737f8f7caa4808d42991eb
SHA512 2f0d7147f9c8beabd422e844804d983767f93bb2699ca8c0c4bd0ef1d41990039b7a9cd6a7da8657060adc57aab9a91640d67dd536571f1156a535f0ddbb4392
SSDEEP 24576:6rLCLBDAbN+gXkrlY0YlNcrwSdFCQ2Z7IsETt6XLo5:6nei8KkrlY0YlNc3dFBQIsW
TLSH
T11775F827B66865D9C17BC078C2839F22792130D90F352FF7469182BA2E25EF96E3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_782d481ee6614a7ced47d15c0ec09de1_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-28_782d481ee6614a7ced47d15c0ec09de1_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.6MB

2026-10-28_782d481ee6614a7ced47d15c0ec09de1_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 529a987834a478f5a9979e6673d476ed
SHA256 3e1bb6a2875c06980c5ca0b124e19b99c68fdfdde64323edb648def196aee4a3
MD5 782d481ee6614a7ced47d15c0ec09de1
SHA1 9bd8643462a1a19f04737f8f7caa4808d42991eb
SHA512 2f0d7147f9c8beabd422e844804d983767f93bb2699ca8c0c4bd0ef1d41990039b7a9cd6a7da8657060adc57aab9a91640d67dd536571f1156a535f0ddbb4392
SSDEEP 24576:6rLCLBDAbN+gXkrlY0YlNcrwSdFCQ2Z7IsETt6XLo5:6nei8KkrlY0YlNc3dFBQIsW
TLSH
T11775F827B66865D9C17BC078C2839F22792130D90F352FF7469182BA2E25EF96E3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1131872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-ec80d8b63edadd6d.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

CloseHandle PeekNamedPipe GetProcAddress LoadLibraryA GetNativeSystemInfo CreateEventA WaitForMultipleObjects WaitForSingleObject OpenSemaphoreA ReleaseSemaphore SetEvent GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW CopyFileExW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CreateFileW InitializeSListHead GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose CreateHardLinkW GetConsoleMode GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx ReadFile QueryPerformanceFrequency CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetExitCodeProcess IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW GetSystemTimeAsFileTime IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter CreateEventW TerminateProcess

advapi32

RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW

ole32

CoInitializeEx CoCreateInstance

oleaut32

SysStringLen SysFreeString

ntdll

RtlNtStatusToDosError NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile

vcruntime140

memcpy __current_exception_context __current_exception __C_specific_handler memcmp memset _CxxThrowException __CxxFrameHandler3 memmove

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _set_app_type _seh_filter_exe _initterm _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_782d481ee6614a7ced47d15c0ec09de1_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic