2026-11-06_db384625287254eddc3a91c94f5fd908_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_db384625287254eddc3a91c94f5fd908_akira_cobalt-strike_rusty-stealer_satacom
Size 288KB
Sample261107-1edrdaf12r
SHA256 2e78d948cc62b0e2521f6a6b283c2986a0643e11d8470257d9428d58382a8cc2
MD5 db384625287254eddc3a91c94f5fd908
SHA1 9db37f762ccfbda0e51a6c54f570dc5534a5bf00
SHA512 c3aa5386eba5182a51bf93633f854f3c4458d4a8a470c5b72e2061d2ec33b560ee2274223b6fb5814fe709d42e37f530ea75a304a050f15de74d9214cf9eee6b
SSDEEP 3072:tjzzL2cO5oiVSoHzwjRmo2wm0SUE9QuuHOnczN6e5XX:t7xO5RVSqz4rsQuuHOn6MoXX
TLSH
T15B544B13FB6065D9D07AC038C25A4B22BA7670CC0B219BE713945225EE57EFC5EBD398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_db384625287254eddc3a91c94f5fd908_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-06_db384625287254eddc3a91c94f5fd908_akira_cobalt-strike_rusty-stealer_satacom

.exe 288KB

2026-11-06_db384625287254eddc3a91c94f5fd908_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 486bc84f5f13778c40473a4cb4774d58
SHA256 2e78d948cc62b0e2521f6a6b283c2986a0643e11d8470257d9428d58382a8cc2
MD5 db384625287254eddc3a91c94f5fd908
SHA1 9db37f762ccfbda0e51a6c54f570dc5534a5bf00
SHA512 c3aa5386eba5182a51bf93633f854f3c4458d4a8a470c5b72e2061d2ec33b560ee2274223b6fb5814fe709d42e37f530ea75a304a050f15de74d9214cf9eee6b
SSDEEP 3072:tjzzL2cO5oiVSoHzwjRmo2wm0SUE9QuuHOnczN6e5XX:t7xO5RVSqz4rsQuuHOn6MoXX
TLSH
T15B544B13FB6065D9D07AC038C25A4B22BA7670CC0B219BE713945225EE57EFC5EBD398
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

158896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-2cdf49866f11227c.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetProcessHeap HeapFree HeapReAlloc CloseHandle lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex GetLastError WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetConsoleMode GetModuleHandleA GetModuleHandleW FormatMessageW HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP QueryPerformanceCounter GetCurrentThreadId IsProcessorFeaturePresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimeAsFileTime

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

memcmp __current_exception_context _CxxThrowException __C_specific_handler __current_exception memmove memset memcpy __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _get_initial_narrow_environment _exit _initialize_narrow_environment _configure_narrow_argv __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_db384625287254eddc3a91c94f5fd908_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic