2026-11-01_dc1dabaa5102516cbc41acf3ade28faf_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_dc1dabaa5102516cbc41acf3ade28faf_akira_cobalt-strike_rusty-stealer_satacom
Size 1.3MB
Sample261102-ha37csfx51
SHA256 02a0582824b45b90bc7ea572a9204d1c1c6ef23c06d294fc3740b6f80a34f58a
MD5 dc1dabaa5102516cbc41acf3ade28faf
SHA1 8f250b024bd9d01abef342b75cb20b631a186305
SHA512 d36810e498d2140079bb691199f8cdaecbde51f931ece8030f6306a4937066e16ef525ef859a50a99a75216e73472d45c0b954b11a40c58afde743e8f53d7f44
SSDEEP 24576:tIGspeBDGhv95C4CudCqZtn4R3q/lA7wwK:tIGspeBDG995C4CuPn4dqNA
TLSH
T15D5509267664A5DDC1BBC0B882838F267A3170C90B356FF745C582792E26EF92E3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_dc1dabaa5102516cbc41acf3ade28faf_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-01_dc1dabaa5102516cbc41acf3ade28faf_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.3MB

2026-11-01_dc1dabaa5102516cbc41acf3ade28faf_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH a53996349c3e7d215c0ad409a1ef12ca
SHA256 02a0582824b45b90bc7ea572a9204d1c1c6ef23c06d294fc3740b6f80a34f58a
MD5 dc1dabaa5102516cbc41acf3ade28faf
SHA1 8f250b024bd9d01abef342b75cb20b631a186305
SHA512 d36810e498d2140079bb691199f8cdaecbde51f931ece8030f6306a4937066e16ef525ef859a50a99a75216e73472d45c0b954b11a40c58afde743e8f53d7f44
SSDEEP 24576:tIGspeBDGhv95C4CudCqZtn4R3q/lA7wwK:tIGspeBDG995C4CuPn4dqNA
TLSH
T15D5509267664A5DDC1BBC0B882838F267A3170C90B356FF745C582792E26EF92E3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

917008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-573a5e4c8e835ef4.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

GetCurrentThreadId CloseHandle LoadLibraryA GetProcAddress GetNativeSystemInfo FreeEnvironmentStringsW CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread WaitForSingleObject QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW FlushFileBuffers SetFileInformationByHandle GetCurrentProcess DuplicateHandle SetFilePointerEx GetStdHandle GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess GetProcessHeap HeapFree GetSystemTimeAsFileTime FindClose CreateHardLinkW CopyFileExW HeapReAlloc lstrlenW ReleaseMutex CreateEventW ReadFile GetOverlappedResult CancelIo GetModuleHandleW FormatMessageW GetModuleFileNameW ExitProcess CreateNamedPipeW ReadFileEx WaitForMultipleObjects CreateThread GetFullPathNameW GetModuleHandleA GetTempPathW HeapAlloc FindNextFileW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW DeleteFileW GetConsoleMode GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetConsoleOutputCP MultiByteToWideChar WideCharToMultiByte WaitForSingleObjectEx CreateMutexA InitializeSListHead SetUnhandledExceptionFilter FindFirstFileExW WriteConsoleW

advapi32

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegQueryValueExW

ole32

CoInitializeEx CoCreateInstance

oleaut32

SysFreeString SysStringLen

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

vcruntime140

__current_exception_context _CxxThrowException memmove memset __CxxFrameHandler3 memcmp __current_exception __C_specific_handler memcpy

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment terminate _initterm _initterm_e exit _exit _crt_atexit __p___argc __p___argv _cexit _c_exit _seh_filter_exe _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_dc1dabaa5102516cbc41acf3ade28faf_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic