2026-10-28_5345f8a74ceb5e8ff5bd03156903c42c_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_5345f8a74ceb5e8ff5bd03156903c42c_akira_cobalt-strike_rusty-stealer_satacom
Size 7.8MB
Sample261030-e6m88saw6k
SHA256 30ae285ee6f12cf142f6368d133a4288bb9b38e6cfd0d014442a62d41b983b64
MD5 5345f8a74ceb5e8ff5bd03156903c42c
SHA1 c3b00040a19172057e2e1a726ae9ead920d9722e
SHA512 7cae824c6fb1dd3d0cbe6ef2756cec1ccb7495c0f1577e4cbba0c6b3a5127fddf693b51c1b1c25aa7a947098447677f474f948c7d26193805992fcd228e99dab
SSDEEP 49152:gJOPeTdNjORd+kmRNKPOT/GCXklvE2EIwkjq3RJ/aDIIB3glcfG8NpZOgDLDni2/:K13/7/xRnbSH1Y/7zA+9GQF
TLSH
T15786E716A76960D9C1BFC07892839F62BD2034D907397BF749D1826A2F24EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_5345f8a74ceb5e8ff5bd03156903c42c_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-10-28_5345f8a74ceb5e8ff5bd03156903c42c_akira_cobalt-strike_rusty-stealer_satacom

.exe 7.8MB

2026-10-28_5345f8a74ceb5e8ff5bd03156903c42c_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 5912222e46686cf9fff35b471cba01ad
SHA256 30ae285ee6f12cf142f6368d133a4288bb9b38e6cfd0d014442a62d41b983b64
MD5 5345f8a74ceb5e8ff5bd03156903c42c
SHA1 c3b00040a19172057e2e1a726ae9ead920d9722e
SHA512 7cae824c6fb1dd3d0cbe6ef2756cec1ccb7495c0f1577e4cbba0c6b3a5127fddf693b51c1b1c25aa7a947098447677f474f948c7d26193805992fcd228e99dab
SSDEEP 49152:gJOPeTdNjORd+kmRNKPOT/GCXklvE2EIwkjq3RJ/aDIIB3glcfG8NpZOgDLDni2/:K13/7/xRnbSH1Y/7zA+9GQF
TLSH
T15786E716A76960D9C1BFC07892839F62BD2034D907397BF749D1826A2F24EF8AD3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5965344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

authorization-1f733173b932471d.pdb

bcryptprimitives

ProcessPrng

kernel32

ReadFile GetOverlappedResult GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetHandleInformation CreateIoCompletionPort CloseHandle SetFileCompletionNotificationModes GetSystemTimeAsFileTime InitializeSListHead FindFirstFileExW GetModuleHandleA WaitForMultipleObjects FormatMessageW GetModuleHandleW GetFileType GetFileAttributesW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar GetModuleFileNameW HeapAlloc GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte GetProcAddress SwitchToThread GetSystemInfo ExitProcess FindClose SetUnhandledExceptionFilter lstrlenW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo RtlVirtualUnwind CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ws2_32

WSASocketW WSAGetLastError getsockopt socket WSAIoctl closesocket setsockopt WSASendMsg getsockname ioctlsocket bind WSACleanup WSAStartup freeaddrinfo getaddrinfo

ntdll

NtWriteFile RtlNtStatusToDosError NtOpenFile NtCancelIoFileEx NtDeviceIoControlFile NtReadFile NtCreateFile NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memmove memcmp memset __CxxFrameHandler3 memcpy

api-ms-win-crt-math-l1-1-0

pow fmod __setusermatherr cbrt floor

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _register_onexit_function _seh_filter_exe _set_app_type _initialize_onexit_table _initterm _configure_narrow_argv _get_initial_narrow_environment _register_thread_local_exe_atexit_callback __p___argv _c_exit _cexit _initterm_e __p___argc exit _exit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_5345f8a74ceb5e8ff5bd03156903c42c_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcrypt

advapi32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic