2026-11-11_6713230f653c385e0633ec55925ffea9_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_6713230f653c385e0633ec55925ffea9_akira_cobalt-strike_rusty-stealer_satacom
Size 879KB
Sample261113-mxgzvsav3x
SHA256 954dfeb3c52bce4ad887b3a972567e9bdcb9c359555a52515d93dd1ead5d2930
MD5 6713230f653c385e0633ec55925ffea9
SHA1 65ae3878f4f5c4f022f9f1e52e468358e01a822c
SHA512 7deca7e8185e2abaab06a64329c384f8b8045c1a32382b40ea76eff847966bff8f25dbbde8cbbccfe67fb5ac869f0e9c5c696f96ed098d08b2268895019e05cc
SSDEEP 12288:hM7tYgutNjZD1TGs6iGYlYI2i3j5kWKE+AEEdoXvtqS:mtYgMZZPGYl72W7d+v/
TLSH
T136155B1AB64A49ACE45AC475834A5A626A3574CB0F32ADFF01C851383F7ABF51F3C319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_6713230f653c385e0633ec55925ffea9_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-11_6713230f653c385e0633ec55925ffea9_akira_cobalt-strike_rusty-stealer_satacom

.exe 879KB

2026-11-11_6713230f653c385e0633ec55925ffea9_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH c2520506a15000f6f9d79db242f9a28f
SHA256 954dfeb3c52bce4ad887b3a972567e9bdcb9c359555a52515d93dd1ead5d2930
MD5 6713230f653c385e0633ec55925ffea9
SHA1 65ae3878f4f5c4f022f9f1e52e468358e01a822c
SHA512 7deca7e8185e2abaab06a64329c384f8b8045c1a32382b40ea76eff847966bff8f25dbbde8cbbccfe67fb5ac869f0e9c5c696f96ed098d08b2268895019e05cc
SSDEEP 12288:hM7tYgutNjZD1TGs6iGYlYI2i3j5kWKE+AEEdoXvtqS:mtYgMZZPGYl72W7d+v/
TLSH
T136155B1AB64A49ACE45AC475834A5A626A3574CB0F32ADFF01C851383F7ABF51F3C319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

604476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

basestation_logger.pdb

kernel32

FillConsoleOutputCharacterA FillConsoleOutputAttribute WaitForSingleObject SetConsoleTextAttribute SetLastError GetFullPathNameW ReadConsoleInputW GetNumberOfConsoleInputEvents GetCurrentThreadId SetFileInformationByHandle SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter WriteConsoleW GetStdHandle CreateConsoleScreenBuffer SetConsoleActiveScreenBuffer CreateThread GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleCursorInfo WaitForMultipleObjects FormatMessageW SetCommBreak PurgeComm GetCommModemStatus ClearCommError GetCurrentProcessId ClearCommBreak RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FlushFileBuffers GetSystemTimePreciseAsFileTime SetCommTimeouts GetFileInformationByHandle GetFileInformationByHandleEx EscapeCommFunction CreateFileW DuplicateHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW GetCurrentProcess lstrlenW FindFirstFileExW FindClose SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetConsoleMode HeapAlloc GetModuleFileNameW MultiByteToWideChar GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetModuleHandleW GetConsoleMode GetSystemTimeAsFileTime InitializeSListHead FindNextFileW WriteFile ReadFile SetCommState GetCommState GetTimeZoneInformationForYear SetUnhandledExceptionFilter GetProcAddress GetModuleHandleA Sleep GetLastError CloseHandle

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

setupapi

SetupDiGetClassDevsW SetupDiOpenDevRegKey SetupDiGetDeviceInstanceIdW SetupDiDestroyDeviceInfoList SetupDiClassGuidsFromNameW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

cfgmgr32

CM_Get_Parent CM_Get_Device_IDW CM_Get_DevNode_Status

advapi32

RegCloseKey RegOpenKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW

user32

GetKeyboardLayout ToUnicodeEx GetWindowThreadProcessId GetForegroundWindow

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

vcruntime140

_CxxThrowException memcmp memmove __CxxFrameHandler3 memcpy __C_specific_handler __current_exception __current_exception_context memset

api-ms-win-crt-math-l1-1-0

log10 log round __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_set_app_type _initterm _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initialize_onexit_table _initterm_e exit _register_onexit_function terminate _exit _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_6713230f653c385e0633ec55925ffea9_akira_cobalt-strike_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

setupapi

cfgmgr32

advapi32

user32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic