Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 10.4MB
- Sample261107-mk2thaef38
- SHA256 c0a372405e2d10c10f63a998fb9777911f67185677691462adc7457061240f3c
- MD5 bd2568ffda5a1c877ee06daa0589eb50
- SHA1 d256401ed418758d12afb2193cc014d24eb002d7
- SHA512 2fb2773cf198a16fde33295adb8002d1341a4fd7f90afcddb5aab74797e725a14a93cf6db7882f7c17353557eddaf61322257b6b0661dd962d8c3c30c2a829cf
- SSDEEP 98304:YZr2/tEu2JAmAF3/2Bii4p75aEt/vGwC5B3CxpTRSAWTvKK/Jvl:3tFeBEEvypgvTLd
- TLSH T1C9B6F811BA5B689CD15AC870834A4A631A303CCB1B35B8FF50D9B1793FBDBF45B29618
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1820 2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe 1820 2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe 1820 2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe 1820 2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1820 2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-07_bd2568ffda5a1c877ee06daa0589eb50_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1820
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\tagnative\Tag\FT\UHEB95.MAP
- Size 3KB
- SHA256 0a15444d6744a4ebf3acc79784ea924fb1d4b44c73f0f0fe156ad5dfdf01ca5b
- MD5 c82cce6802ccc4f8b4dcb3fdcf21b3fb
- SHA1 99600cd312ff8efa3bad9aa08070e87305646004
- SHA512 5c4075cd0602159141b607b0ab579104866574cec66c061377016cde5952db67db1496210f381aa6dfb35763fb504a57ba9045e1161556768989e803a5ca83ee
- TLSH T1EB819C912C486557795FE16669A159AFE21D920320ABFC373FFC26C62740414BBC7E0C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\tagnative\Tag\FT\UIDENTIT.MAP
- Size 1KB
- SHA256 f7aa42895173cfbdd1cd46382e961fd21c4a0742bb908f820411dee865306b50
- MD5 73fcc07ce7da91a3dba7bfe3494aed1d
- SHA1 d0b7d1a7b9b56168c31f170f6d2b243c8d18051f
- SHA512 335f270ab060ad62aecb7229f21c1eb9cfde539dd5d90e33f6969a1b4905e059296209f2b71b365c66d465617d1f0ba223d6b673432a5537387fa4ab92b06a22
- TLSH T13E4155AA43781BCD886C383A6771A5F942F7FF5A1905D485C339BE83367790FE842860
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\tagnative\Tag\TAG.INI
- Size 2KB
- SHA256 33ab038822766b32ac2db341c5f13c6fe6c87ac8e3f73fffb1e1add2fd3a9aa7
- MD5 07244c8dbedf9354778c7c6a208a6cb7
- SHA1 f90476e4ced2a912518e849cb908a5d47d7f918c
- SHA512 c281fadca6d65f15d3bdd055a850562770a7b351b885af4ce7393db35d85ba04e6f484bfc7edd3cfce241f9f3b88bec7dd5145296a9326fecb08e20eea605128
- TLSH T1C641DA427544D3316C702C30727E7FC1A3995F6C61B57A0580AE8C2A5B858F106692FF
- MD5 SHA1 SHA512 TLSH