2026-11-10_30e2e79362a67c24c41de67e14d59686_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_30e2e79362a67c24c41de67e14d59686_akira_cobalt-strike_rusty-stealer_satacom
Size 12.8MB
Sample261110-krtqcsvz8p
SHA256 1c5eb0cca8adc56f924d2a716d5db4a45aaef7a9b7cb4c062a03f2c8cddc1a62
MD5 30e2e79362a67c24c41de67e14d59686
SHA1 8a597a336963daf1983333d1fa68504373f2186c
SHA512 190a8f2e4818a4414dc275a3c29980f4102fa40d29661b7bfc2c1bc842f585b82b1498784d2bd244ac4bb73e88349743df49f54729edf670c31d9fdd8bfc40ba
SSDEEP 393216:Uc87HX4SXoac5BYo9y/QPyLAoBU46eJql6i:E7HoSYZwf/qay4Q
TLSH
T1FFD62355E497D698C046C0748F4F4B225AB43CC60B32A4DF51E4BDB92FAAFE01F2971A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_30e2e79362a67c24c41de67e14d59686_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-10_30e2e79362a67c24c41de67e14d59686_akira_cobalt-strike_rusty-stealer_satacom

.exe 12.8MB

2026-11-10_30e2e79362a67c24c41de67e14d59686_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH 0b591444fa158561e22c4059d59877e5
SHA256 1c5eb0cca8adc56f924d2a716d5db4a45aaef7a9b7cb4c062a03f2c8cddc1a62
MD5 30e2e79362a67c24c41de67e14d59686
SHA1 8a597a336963daf1983333d1fa68504373f2186c
SHA512 190a8f2e4818a4414dc275a3c29980f4102fa40d29661b7bfc2c1bc842f585b82b1498784d2bd244ac4bb73e88349743df49f54729edf670c31d9fdd8bfc40ba
SSDEEP 393216:Uc87HX4SXoac5BYo9y/QPyLAoBU46eJql6i:E7HoSYZwf/qay4Q
TLSH
T1FFD62355E497D698C046C0748F4F4B225AB43CC60B32A4DF51E4BDB92FAAFE01F2971A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1012544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

roman_history_game.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

imm32

ImmSetOpenStatus ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW ImmCreateContext ImmAssociateContext ImmAssociateContextEx ImmGetOpenStatus ImmGetContext ImmReleaseContext

gdi32

ChoosePixelFormat SetPixelFormat DescribePixelFormat DeleteObject CreateBitmap SwapBuffers CreateDIBSection GetStockObject

kernel32

GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter CloseHandle GetModuleHandleW GetProcAddress GlobalLock GlobalSize GlobalAlloc GlobalUnlock FreeLibrary GetLastError LoadLibraryA WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId MoveFileExW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessId LockFileEx GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW CopyFileExW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex DeleteFileW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP FormatMessageW GetModuleFileNameW GetModuleHandleA

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

shell32

DragQueryFileW DragAcceptFiles

user32

GetClipboardData CloseClipboard SetClipboardData EmptyClipboard SetProcessDPIAware ShowWindow RegisterRawInputDevices SetWindowLongPtrA PeekMessageW TranslateMessage DispatchMessageW GetMessageW PostMessageW DestroyWindow LoadCursorW LoadIconW RegisterClassW GetSystemMetrics AdjustWindowRectEx CreateWindowExW GetDC GetWindowLongPtrA GetKeyState DefWindowProcW SetTimer KillTimer GetCaretPos GetRawInputData SetCursor PostQuitMessage GetClientRect GetWindowLongA ShowCursor ClientToScreen SetRect ClipCursor SetWindowPos GetWindowRect MonitorFromPoint ReleaseDC CreateIconIndirect SendMessageW OpenClipboard

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

vcruntime140

__current_exception __C_specific_handler __current_exception_context memcmp memset memmove memcpy __CxxFrameHandler3 _CxxThrowException

api-ms-win-crt-math-l1-1-0

ceil __setusermatherr roundf cosf sinf fmodf floorf ceilf

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _crt_atexit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_30e2e79362a67c24c41de67e14d59686_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

imm32

gdi32

kernel32

api-ms-win-shcore-scaling-l1-1-1

shell32

user32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic