2026-11-01_bab0a786b7d2950769f082a39163fd27_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_bab0a786b7d2950769f082a39163fd27_akira_cobalt-strike_rusty-stealer_satacom
Size 2.0MB
Sample261102-mgd82abs3l
SHA256 c8abe714d2edf37042c208a1fb0186dca6cb9e2102e69a995bceeba717270dac
MD5 bab0a786b7d2950769f082a39163fd27
SHA1 cc2d69490a057db42192bbf9207b828aeececacf
SHA512 a541ad685ba0b198c0dc022a743bfe01301a4a95a93da2a59aa693ddc98b0d484e90cc764a96d7b952d7bb0d2d8f85259bd4c434bfea1f8f42f28b8f3034d81c
SSDEEP 24576:yxxBlDLb7sqPD36HMkDlzetmgKTmEZgUXuFxWf:yxxBlDrsvHMWzhgKTFZfXu3
TLSH
T1A8950711BA5A69ACC49AC4B083564A735A3070CF1B36B8FF44D495793FAAEF51B3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bab0a786b7d2950769f082a39163fd27_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-01_bab0a786b7d2950769f082a39163fd27_akira_cobalt-strike_rusty-stealer_satacom

.exe 2.0MB

2026-11-01_bab0a786b7d2950769f082a39163fd27_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 795c57865a1c1354aae8a740820f89be
SHA256 c8abe714d2edf37042c208a1fb0186dca6cb9e2102e69a995bceeba717270dac
MD5 bab0a786b7d2950769f082a39163fd27
SHA1 cc2d69490a057db42192bbf9207b828aeececacf
SHA512 a541ad685ba0b198c0dc022a743bfe01301a4a95a93da2a59aa693ddc98b0d484e90cc764a96d7b952d7bb0d2d8f85259bd4c434bfea1f8f42f28b8f3034d81c
SSDEEP 24576:yxxBlDLb7sqPD36HMkDlzetmgKTmEZgUXuFxWf:yxxBlDrsvHMWzhgKTFZfXu3
TLSH
T1A8950711BA5A69ACC49AC4B083564A735A3070CF1B36B8FF44D495793FAAEF51B3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1531568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Traylang.pdb

ole32

PropVariantClear CoUninitialize CoDisableCallCancellation CoCancelCall CoCreateInstance CoSetProxyBlanket CoEnableCallCancellation CoInitializeEx

kernel32

OpenEventW CreatePipe WaitForMultipleObjects GetCurrentThreadId ResetEvent QueryFullProcessImageNameW SetEvent CreateEventW GlobalFree CancelSynchronousIo GetSystemTime GetProcessHeap GetModuleHandleW LocalFree FormatMessageW HeapAlloc HeapFree GetLastError CloseHandle WaitForSingleObject CreateMutexW GetProcessTimes GetCurrentProcess GetCurrentProcessId IsProcessorFeaturePresent OpenProcess GlobalAlloc GetLocaleInfoW ReleaseMutex GetProcAddress LoadLibraryExA GlobalLock GlobalUnlock GlobalSize GetThreadId PeekNamedPipe GetTickCount64 GetSystemTimeAsFileTime DuplicateHandle SetUnhandledExceptionFilter CompareStringOrdinal FreeEnvironmentStringsW UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead WriteFileEx SleepEx SetLastError GetFullPathNameW MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW CopyFileExW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA DeleteFileW ReadConsoleW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetModuleFileNameW GetModuleHandleA

user32

MonitorFromRect ModifyMenuW EnumDisplayMonitors DispatchMessageW TranslateMessage EnumWindows EnumDisplayDevicesW IsZoomed IsIconic MonitorFromWindow EndPaint BeginPaint DeregisterShellHookWindow GetSystemMetricsForDpi DestroyMenu TrackPopupMenu CreatePopupMenu GetMessageW RegisterShellHookWindow SetProcessDpiAwarenessContext AppendMenuW PostMessageW GetClassNameW GetWindowLongPtrW SendInput GetClipboardSequenceNumber GetClipboardOwner GetWindowThreadProcessId SendMessageTimeoutW GetAsyncKeyState GetGUIThreadInfo GetAncestor SetFocus MessageBoxW DefWindowProcW CheckRadioButton SetPropW GetMonitorInfoW MonitorFromPoint GetCursorPos GetDpiForSystem RegisterClassW IsChild GetSysColorBrush SetForegroundWindow SystemParametersInfoForDpi GetWindowTextW GetWindowTextLengthW SetWindowTextW GetDpiForWindow AdjustWindowRectExForDpi ScreenToClient GetParent InvalidateRect EnumChildWindows SetTimer KillTimer ShowWindow EnableWindow RedrawWindow GetDlgItem IsDialogMessageW ReleaseDC GetWindowDC GetDlgCtrlID RemovePropW CallWindowProcW GetPropW SetWindowPos GetWindow IsWindowVisible GetWindowRect IsWindow GetTopWindow GetKeyboardLayoutList ToUnicodeEx MapVirtualKeyExW GetDC SetWinEventHook VkKeyScanExW RegisterHotKey CallNextHookEx SetWindowsHookExW UnregisterHotKey UnhookWinEvent UnhookWindowsHookEx GetGuiResources ClientToScreen DrawTextW FillRect LoadImageW RegisterWindowMessageW GetKeyboardLayout GetClientRect LoadCursorW GetKeyState SetWindowLongPtrW RegisterClipboardFormatW GetClipboardData GetClipboardFormatNameW EnumClipboardFormats OpenWindowStationW SetClipboardData EmptyClipboard OpenClipboard GetUserObjectInformationW SendMessageW CloseDesktop DestroyWindow SetThreadDesktop CreateDesktopW CloseWindowStation SetProcessWindowStation CreateWindowStationW GetThreadDesktop GetProcessWindowStation OpenDesktopW CreateWindowExW CloseClipboard GetForegroundWindow

advapi32

GetTokenInformation RegEnumKeyExW OpenProcessToken RegOpenKeyExW GetSidSubAuthorityCount CredDeleteW CredWriteW CredFree CredReadW RegQueryValueExW GetSidSubAuthority ConvertSidToStringSidW RegCloseKey

gdi32

CreatePen DeleteObject SetTextColor GetStockObject DeleteDC SetBkMode GdiFlush Rectangle SelectObject BitBlt CreateSolidBrush CreateFontIndirectW CreateDIBSection CreateCompatibleDC

shell32

Shell_NotifyIconW ShellExecuteW

oleaut32

GetErrorInfo SysAllocStringLen SysFreeString SysStringLen SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement VariantClear

psapi

GetProcessMemoryInfo

shlwapi

SHLoadIndirectString

dwmapi

DwmGetWindowAttribute

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpSetOption WinHttpSetStatusCallback WinHttpSendRequest WinHttpReceiveResponse WinHttpReadData

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

propsys

VariantToPropVariant PropVariantToBSTR VariantToBoolean VariantToUInt32

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile

vcruntime140

memcmp memcpy memmove __current_exception_context __CxxFrameHandler3 __C_specific_handler _CxxThrowException memset __current_exception

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _c_exit _seh_filter_exe _set_app_type _register_onexit_function _cexit exit __p___argv _configure_narrow_argv _initialize_narrow_environment __p___argc _exit _get_initial_narrow_environment _initterm _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_bab0a786b7d2950769f082a39163fd27_akira_cobalt-strike_rusty-stealer_satacom

ole32

kernel32

user32

advapi32

gdi32

shell32

oleaut32

psapi

shlwapi

dwmapi

winhttp

api-ms-win-core-synch-l1-2-0

api-ms-win-shcore-scaling-l1-1-1

propsys

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic