Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe
- Size 10.4MB
- Sample261107-zapseae13v
- SHA256 366fea554179af49b9666da9012a370aebb5713c57763014f7f78a2d9d23f9e7
- MD5 e3e7117d0877c6bb845a33a261b0a752
- SHA1 5694bf733d0fe5c3bf730d45385c22007bcdeb9e
- SHA512 9d68acc2622adc070b88d4590a92ff8a91e23bd53450be1f89d8fe65a0253f80af5f7e4067be7fbfcb0b6b4e4b8c5df51653f6adb7c00bb26cd19f36ea25ecac
- SSDEEP 98304:Qg6XI46q1KirkystxpM/E0/ZoitUU7cF9bGh6adt2/tOImxK:r4Pj4zMvyHCBxK
- TLSH T10FB6F711BA5B689CD15AC870834A4A631A303CDB1B35B8FF50D9B1793FBDBE45B38618
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3232 2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe 3232 2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe 3232 2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe 3232 2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3232 2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_e3e7117d0877c6bb845a33a261b0a752_akira_cobalt-strike_rusty-stealer_satacom.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3232
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\tagnative\Tag\FT\UHEB95.MAP
- Size 3KB
- SHA256 0a15444d6744a4ebf3acc79784ea924fb1d4b44c73f0f0fe156ad5dfdf01ca5b
- MD5 c82cce6802ccc4f8b4dcb3fdcf21b3fb
- SHA1 99600cd312ff8efa3bad9aa08070e87305646004
- SHA512 5c4075cd0602159141b607b0ab579104866574cec66c061377016cde5952db67db1496210f381aa6dfb35763fb504a57ba9045e1161556768989e803a5ca83ee
- TLSH T1EB819C912C486557795FE16669A159AFE21D920320ABFC373FFC26C62740414BBC7E0C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\tagnative\Tag\FT\UIDENTIT.MAP
- Size 1KB
- SHA256 f7aa42895173cfbdd1cd46382e961fd21c4a0742bb908f820411dee865306b50
- MD5 73fcc07ce7da91a3dba7bfe3494aed1d
- SHA1 d0b7d1a7b9b56168c31f170f6d2b243c8d18051f
- SHA512 335f270ab060ad62aecb7229f21c1eb9cfde539dd5d90e33f6969a1b4905e059296209f2b71b365c66d465617d1f0ba223d6b673432a5537387fa4ab92b06a22
- TLSH T13E4155AA43781BCD886C383A6771A5F942F7FF5A1905D485C339BE83367790FE842860
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\tagnative\Tag\TAG.INI
- Size 2KB
- SHA256 33ab038822766b32ac2db341c5f13c6fe6c87ac8e3f73fffb1e1add2fd3a9aa7
- MD5 07244c8dbedf9354778c7c6a208a6cb7
- SHA1 f90476e4ced2a912518e849cb908a5d47d7f918c
- SHA512 c281fadca6d65f15d3bdd055a850562770a7b351b885af4ce7393db35d85ba04e6f484bfc7edd3cfce241f9f3b88bec7dd5145296a9326fecb08e20eea605128
- TLSH T1C641DA427544D3316C702C30727E7FC1A3995F6C61B57A0580AE8C2A5B858F106692FF
- MD5 SHA1 SHA512 TLSH