2026-11-01_a7a49dc3393aa757c31ae87764140051_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_a7a49dc3393aa757c31ae87764140051_akira_cobalt-strike_rusty-stealer_satacom
Size 2.2MB
Sample261102-ppldeswt3m
SHA256 002bf8aa08963d5e1d0663dbcdada34a7ed1c98631b8b48196eac04e9c8df842
MD5 a7a49dc3393aa757c31ae87764140051
SHA1 b0260f9d1d8075fcb71def8effade3d5b7aa62ce
SHA512 4fd71884c7967e8de38250aa4da316939a9f409aad507ae644e0ed386218e70f5b7e926b2820bd70d55790f6b95a326a621743100ca128e761cadfdaae8a2468
SSDEEP 49152:wJ+Ph45oQ5mnY52JjUHyjSMGZU043hSaEi7SWQ:V252JwgfL7SWQ
TLSH
T169A51916B66960E9C1BAC07892838F227D3170DE0B397BF74980827A2F65EF46D7D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_a7a49dc3393aa757c31ae87764140051_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-01_a7a49dc3393aa757c31ae87764140051_akira_cobalt-strike_rusty-stealer_satacom

.exe 2.2MB

2026-11-01_a7a49dc3393aa757c31ae87764140051_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 8c932dc54c0556b9c398cdaf62cbfa6a
SHA256 002bf8aa08963d5e1d0663dbcdada34a7ed1c98631b8b48196eac04e9c8df842
MD5 a7a49dc3393aa757c31ae87764140051
SHA1 b0260f9d1d8075fcb71def8effade3d5b7aa62ce
SHA512 4fd71884c7967e8de38250aa4da316939a9f409aad507ae644e0ed386218e70f5b7e926b2820bd70d55790f6b95a326a621743100ca128e761cadfdaae8a2468
SSDEEP 49152:wJ+Ph45oQ5mnY52JjUHyjSMGZU043hSaEi7SWQ:V252JwgfL7SWQ
TLSH
T169A51916B66960E9C1BAC07892838F227D3170DE0B397BF74980827A2F65EF46D7D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1556960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

symforge_core-de5deaa3ec15536d.pdb

bcryptprimitives

ProcessPrng

advapi32

GetTokenInformation CredFree CredReadW RegGetValueW OpenProcessToken CredWriteW CredDeleteW

ntdll

NtReadFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

kernel32

QueryPerformanceCounter GetTempPathW GetFullPathNameW GetFileType QueryPerformanceFrequency FindFirstFileExW DeleteFileW SwitchToThread GetFileInformationByHandleEx GetFinalPathNameByHandleW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee GetSystemInfo AddVectoredExceptionHandler GetExitCodeProcess GetModuleFileNameW GetProcessHeap HeapFree RtlCaptureContext DuplicateHandle SetFileTime SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx WideCharToMultiByte HeapReAlloc WaitForSingleObject CreateEventW CancelIo GetEnvironmentVariableW RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentThreadId GetSystemTimePreciseAsFileTime MultiByteToWideChar WriteConsoleW GetConsoleOutputCP GetConsoleMode LoadLibraryA SetConsoleTextAttribute GetConsoleScreenBufferInfo GetFileAttributesW HeapAlloc GetOverlappedResult ReadFile CreateThread FormatMessageW WaitForMultipleObjects FindClose ReadFileEx SleepEx DeviceIoControl CreateFileW FindNextFileW GetDriveTypeW FindFirstFileW CreateHardLinkW CreateDirectoryW RemoveDirectoryW GetFileAttributesExW GetVolumeInformationW GetFileInformationByHandle SetFileInformationByHandle lstrlenW DeleteCriticalSection FreeEnvironmentStringsW GetSystemTimeAsFileTime CompareStringOrdinal RtlPcToFileHeader GetSystemDirectoryW GetWindowsDirectoryW RaiseException CreateProcessW FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeSListHead WriteFileEx SetUnhandledExceptionFilter RtlUnwindEx GetStdHandle GetModuleHandleW GetCurrentProcess GetModuleHandleA GetProcAddress GetLastError CloseHandle InitializeCriticalSectionEx ExitProcess

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

userenv

GetUserProfileDirectoryW

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-math-l1-1-0

floor __setusermatherr fmod

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-runtime-l1-1-0

exit _configure_narrow_argv _initterm_e _initterm __p___argc abort _initialize_narrow_environment terminate _crt_atexit _register_onexit_function __p___argv _cexit _get_initial_narrow_environment _set_app_type _seh_filter_exe _exit _register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_a7a49dc3393aa757c31ae87764140051_akira_cobalt-strike_rusty-stealer_satacom

bcryptprimitives

advapi32

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

userenv

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic