2026-11-12_14c4caec55a9b13c0bee5215294739cc_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_14c4caec55a9b13c0bee5215294739cc_akira_cobalt-strike_rusty-stealer_satacom
Size 1.9MB
Sample261113-jrrekaht21
SHA256 ba26f96785b5607f552da555e11544b6eb5adb9ee9fd2104fea2a546b0869a78
MD5 14c4caec55a9b13c0bee5215294739cc
SHA1 594f8162589a81e3f3c0d601aa81bfd0265a98b5
SHA512 8bff7ec07fa778b9d95c936c1510fc0844dc49aa79895a5eb141bc59b8385214caa599eb03d49719ab595744081467ecab945708124b209324aa2d2c60f8ff39
SSDEEP 49152:XIomZPxCtfMWjrvNF1e2UY6uqgFPDRentycnveFVtA8ulxK:YeUg48N
TLSH
T14395B726A67994DDC1BAC0B8D2839F62BD21748D07383BF749D082662F25EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_14c4caec55a9b13c0bee5215294739cc_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-12_14c4caec55a9b13c0bee5215294739cc_akira_cobalt-strike_rusty-stealer_satacom

.exe 1.9MB

2026-11-12_14c4caec55a9b13c0bee5215294739cc_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH d40782307175b28591758bea14b667e9
SHA256 ba26f96785b5607f552da555e11544b6eb5adb9ee9fd2104fea2a546b0869a78
MD5 14c4caec55a9b13c0bee5215294739cc
SHA1 594f8162589a81e3f3c0d601aa81bfd0265a98b5
SHA512 8bff7ec07fa778b9d95c936c1510fc0844dc49aa79895a5eb141bc59b8385214caa599eb03d49719ab595744081467ecab945708124b209324aa2d2c60f8ff39
SSDEEP 49152:XIomZPxCtfMWjrvNF1e2UY6uqgFPDRentycnveFVtA8ulxK:YeUg48N
TLSH
T14395B726A67994DDC1BAC0B8D2839F62BD21748D07383BF749D082662F25EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1506960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qr_lab.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

SetFileInformationByHandle GetStdHandle GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess TerminateProcess GetProcessHeap HeapFree HeapReAlloc GetCommandLineW ReleaseMutex GetModuleHandleW FormatMessageW GetModuleFileNameW ExitProcess GetEnvironmentVariableW ReadFileEx CreateThread CreateWaitableTimerExW SetWaitableTimer Sleep GetFullPathNameW GetModuleHandleA HeapAlloc CreateFileW GetConsoleMode SetUnhandledExceptionFilter GetEnvironmentStringsW GetCurrentDirectoryW SetLastError RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext UnhandledExceptionFilter GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA GetCurrentThreadId GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetLastError CompareStringOrdinal FreeEnvironmentStringsW GetProcessIoCounters K32GetProcessMemoryInfo GetProcessTimes GetProcessId DuplicateHandle GetCurrentProcess GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency InitializeSListHead WaitForSingleObject CloseHandle GetProcAddress IsDebuggerPresent lstrlenW IsProcessorFeaturePresent

bcrypt

BCryptGenRandom

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtWriteFile NtOpenFile

vcruntime140

__current_exception_context memmove memcmp memset _CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception memcpy

api-ms-win-crt-runtime-l1-1-0

exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _initialize_onexit_table _initialize_narrow_environment _register_onexit_function _crt_atexit terminate _configure_narrow_argv _set_app_type _seh_filter_exe _initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_14c4caec55a9b13c0bee5215294739cc_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

kernel32

bcrypt

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic