2026-11-07_411d66f541885b4b56e2b0efa414801a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_411d66f541885b4b56e2b0efa414801a_akira_cobalt-strike_coinminer_rusty-stealer_satacom
Size 2.1MB
Sample261107-settlay1cz
SHA256 52a5aa7ff313fd2b1e5141a086ddfbd4bd3cb3260493c8228d159bdd731d43e1
MD5 411d66f541885b4b56e2b0efa414801a
SHA1 cd78fae9726f61de5c3f84fa613d83c4e62306f6
SHA512 5afc4f61de5ccada1652562706bc60670fa3622f3d09ca5da21cfe34309d65b4dbca46ca5dd07c578d471a503785f31b776776a247d39ecd227aed0815c95ce0
SSDEEP 49152:FvtCNKkdw10lKsPI6MbRTJhOAegnNwQy3T7/WCnrR5:DMg6MbLEX
TLSH
T1A4A55B11B75A58E9C16BC43483468A63AA3130CE1B36BEFF059452793F7ABE45F39318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_411d66f541885b4b56e2b0efa414801a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

File Explorer

2026-11-07_411d66f541885b4b56e2b0efa414801a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

.exe 2.1MB

2026-11-07_411d66f541885b4b56e2b0efa414801a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

IMPHASH 72ee741cfadf8edd691d7d84f2997889
SHA256 52a5aa7ff313fd2b1e5141a086ddfbd4bd3cb3260493c8228d159bdd731d43e1
MD5 411d66f541885b4b56e2b0efa414801a
SHA1 cd78fae9726f61de5c3f84fa613d83c4e62306f6
SHA512 5afc4f61de5ccada1652562706bc60670fa3622f3d09ca5da21cfe34309d65b4dbca46ca5dd07c578d471a503785f31b776776a247d39ecd227aed0815c95ce0
SSDEEP 49152:FvtCNKkdw10lKsPI6MbRTJhOAegnNwQy3T7/WCnrR5:DMg6MbLEX
TLSH
T1A4A55B11B75A58E9C16BC43483468A63AA3130CE1B36BEFF059452793F7ABE45F39318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1522128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vid.pdb

kernel32

GetProcessHeap Sleep GetSystemTimeAsFileTime GetConsoleScreenBufferInfo SetConsoleTextAttribute LocalFree GetModuleHandleA GetProcAddress SetConsoleMode GetTimeZoneInformationForYear ReadProcessMemory OpenProcess IsWow64Process2 CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCurrentProcessId GetCurrentThreadId CloseHandle HeapFree GetLastError GetConsoleMode GetStdHandle LoadLibraryExA FormatMessageW GetFileType InitializeSListHead GetModuleHandleW SetUnhandledExceptionFilter GetConsoleOutputCP WriteConsoleW MultiByteToWideChar GetModuleFileNameW HeapAlloc GetFinalPathNameByHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte ExitProcess FindClose FindFirstFileExW lstrlenW QueryPerformanceCounter WaitForSingleObject SetWaitableTimer CreateWaitableTimerA GetSystemInfo VirtualAlloc VirtualFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection OpenThread FormatMessageA QueryPerformanceFrequency GetLogicalProcessorInformation AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetSystemTime SystemTimeToFileTime VirtualProtect SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

oleaut32

SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__intrinsic_setjmp _CxxThrowException __current_exception __current_exception_context memset memmove memcmp memcpy __CxxFrameHandler3 longjmp __C_specific_handler

api-ms-win-crt-math-l1-1-0

ceil cos floor log pow sin tan _dsign log2 _dpcomp _fdpcomp __setusermatherr _dclass sqrtf fma atan2 sqrt

api-ms-win-crt-heap-l1-1-0

realloc malloc free _set_new_mode calloc

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func __p__commode __stdio_common_vsprintf _set_fmode

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment terminate _crt_atexit _get_initial_narrow_environment _register_onexit_function _initialize_onexit_table strerror _initterm _initterm_e _exit __p___argc __p___argv _cexit _c_exit _errno abort _beginthreadex _endthreadex _register_thread_local_exe_atexit_callback exit

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_411d66f541885b4b56e2b0efa414801a_akira_cobalt-strike_coinminer_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

oleaut32

bcryptprimitives

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic