2026-11-13_ef0357e6ce568c70c667e21c86f12ca1_akira_cobalt-strike_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-13_ef0357e6ce568c70c667e21c86f12ca1_akira_cobalt-strike_rusty-stealer_satacom
Size 2.5MB
Sample261113-yxtjfa1w4k
SHA256 40ff21dff004a310f427dee2ee3c03aeba9b848027db2add92261497b66ca79f
MD5 ef0357e6ce568c70c667e21c86f12ca1
SHA1 9c87a858a996a59779f31a401bc5657f44dbcd18
SHA512 5fe85c21a13ee7ba072eca9cab85864bddf86e7e9ecf9670be0e8bf8a1f067be77e984d2def9e4bdc580421a95398160c76292ffe931115b298363e23194fc88
SSDEEP 24576:Nt3xtodgf2MIQGb5xyZOKFI2fXTF5YLw1P3yPcCPIFd4k2XlkSxeMvqVEkFUZnKk:NVxGBQGbOvt79P3Scn52kKW1+
TLSH
T1E2C5A217B6CABED8CD1AC330464BCF115DA13C424A966BA33792431F2E6B7D8BD24E15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-13_ef0357e6ce568c70c667e21c86f12ca1_akira_cobalt-strike_rusty-stealer_satacom

File Explorer

2026-11-13_ef0357e6ce568c70c667e21c86f12ca1_akira_cobalt-strike_rusty-stealer_satacom

.exe 2.5MB

2026-11-13_ef0357e6ce568c70c667e21c86f12ca1_akira_cobalt-strike_rusty-stealer_satacom

IMPHASH d0606fa69cbee2a729cdabd97d1bc416
SHA256 40ff21dff004a310f427dee2ee3c03aeba9b848027db2add92261497b66ca79f
MD5 ef0357e6ce568c70c667e21c86f12ca1
SHA1 9c87a858a996a59779f31a401bc5657f44dbcd18
SHA512 5fe85c21a13ee7ba072eca9cab85864bddf86e7e9ecf9670be0e8bf8a1f067be77e984d2def9e4bdc580421a95398160c76292ffe931115b298363e23194fc88
SSDEEP 24576:Nt3xtodgf2MIQGb5xyZOKFI2fXTF5YLw1P3yPcCPIFd4k2XlkSxeMvqVEkFUZnKk:NVxGBQGbOvt79P3Scn52kKW1+
TLSH
T1E2C5A217B6CABED8CD1AC330464BCF115DA13C424A966BA33792431F2E6B7D8BD24E15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1125408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bm_p7_base.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime FindNextFileW RtlVirtualUnwind RtlLookupFunctionEntry CloseHandle GetSystemInfo UnmapViewOfFile VirtualProtect CreateFileMappingW MapViewOfFile GetCurrentProcess DuplicateHandle GetProcessHeap HeapFree HeapReAlloc lstrlenW GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex GetLastError SetFileInformationByHandle WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CreateFileW GetFileInformationByHandle FindFirstFileExW FindClose GetConsoleMode GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetModuleHandleW FormatMessageW QueryPerformanceFrequency HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread GetSystemTimePreciseAsFileTime QueryPerformanceCounter RtlCaptureContext

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception_context __C_specific_handler memcmp memset memmove memcpy __CxxFrameHandler3 _CxxThrowException __current_exception

api-ms-win-crt-math-l1-1-0

round ceil floor log pow __setusermatherr exp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argc _initialize_onexit_table terminate _seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback _c_exit __p___argv _cexit _register_onexit_function

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-13_ef0357e6ce568c70c667e21c86f12ca1_akira_cobalt-strike_rusty-stealer_satacom

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic