2026-11-12_62fdd22e94f858849f084db8c1ea0d8d_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_62fdd22e94f858849f084db8c1ea0d8d_akira_cobalt-strike_rusty-stealer_satacom
Size 1.2MB
Sample261113-b36dvsew2v
SHA256 779ffdb28bbd70e88bcde18c20b5eeab3e35785360c00eaba986d6bccb80e397
MD5 62fdd22e94f858849f084db8c1ea0d8d
SHA1 ffb41c184d88f80cb70bdf4da40acbc47dd118b5
SHA512 95275b5ad165d20132cf388a9b2b5cb1314ff9648680341d8b2ff52a80e99ff7d912a6a1917311bc18256881236022d6929fa10230676ded247d3450ed6827d6
SSDEEP 12288:o3nmJLR31pn1+NFVQWyvvoXXnV0TIuyuxaj2CNllnqVh2XkN/oXll2ZT:o3mJl3r1+NFVQWyvAX6Iuyu8XjkNmaZ
TLSH
T1E345F81666A8A5E9C17BC0B9C2838F61792130C90B396FF745D1927A2F26DFD6E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_62fdd22e94f858849f084db8c1ea0d8d_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-12_62fdd22e94f858849f084db8c1ea0d8d_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.2MB

2026-11-12_62fdd22e94f858849f084db8c1ea0d8d_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH f1103ec41c36049ec3acbe2505cc5333
SHA256 779ffdb28bbd70e88bcde18c20b5eeab3e35785360c00eaba986d6bccb80e397
MD5 62fdd22e94f858849f084db8c1ea0d8d
SHA1 ffb41c184d88f80cb70bdf4da40acbc47dd118b5
SHA512 95275b5ad165d20132cf388a9b2b5cb1314ff9648680341d8b2ff52a80e99ff7d912a6a1917311bc18256881236022d6929fa10230676ded247d3450ed6827d6
SSDEEP 12288:o3nmJLR31pn1+NFVQWyvvoXXnV0TIuyuxaj2CNllnqVh2XkN/oXll2ZT:o3mJl3r1+NFVQWyvAX6Iuyu8XjkNmaZ
TLSH
T1E345F81666A8A5E9C17BC0B9C2838F61792130C90B396FF745D1927A2F26DFD6E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

880544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-49e9a7a5fbbd7537.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetSystemTimeAsFileTime CloseHandle GetProcAddress LoadLibraryA GetNativeSystemInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess InitializeSListHead CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW CopyFileExW FindFirstFileExW FindClose CreateHardLinkW ExitProcess WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetModuleHandleW FormatMessageW WaitForMultipleObjects GetTempPathW FindNextFileW SetUnhandledExceptionFilter GetStdHandle GetModuleHandleA

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysStringLen

ntdll

NtReadFile NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtOpenFile

vcruntime140

__current_exception __current_exception_context _CxxThrowException memmove memcmp memcpy __CxxFrameHandler3 memset __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv _register_onexit_function _get_initial_narrow_environment _initterm _initterm_e exit _exit _initialize_onexit_table __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback terminate _initialize_narrow_environment _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_62fdd22e94f858849f084db8c1ea0d8d_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic