2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 3.7MB
Sample260502-hlmzhsat21
SHA256 187dda8694b772e25a3fb7907b9ed7880e83df1a88acb9cc287d08e9ecb57260
MD5 af0749b4e6f245c7e1b9ec49e3ecb671
SHA1 45e2f532f8458650e6871b1dd7ed8d500eecebe8
SHA512 f5009f7056157c070404a9b0f4699358aee61aee8ce0bb3ebb35ce4cbc9cd93da50ba101e2b8c5d1d37cdc39ed7f023d741c1ff0b800654917d382bc58b4622d
SSDEEP 49152:xLNOBEWHM6EkH3a8jCZctTJm6ODno4wYoLqqP6AHhSliIT/IjjuRdgq:x4Aw3a8jgcee5Y1qPxHhk/5gq
TLSH
T11D06E021FE1B046AD47FC6B846EA5B28627838EFC75063EB02B41660BEE74F54D749C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 3.7MB

2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 171bc0fb96cd3353bec45c9b39b9d18c
SHA256 187dda8694b772e25a3fb7907b9ed7880e83df1a88acb9cc287d08e9ecb57260
MD5 af0749b4e6f245c7e1b9ec49e3ecb671
SHA1 45e2f532f8458650e6871b1dd7ed8d500eecebe8
SHA512 f5009f7056157c070404a9b0f4699358aee61aee8ce0bb3ebb35ce4cbc9cd93da50ba101e2b8c5d1d37cdc39ed7f023d741c1ff0b800654917d382bc58b4622d
SSDEEP 49152:xLNOBEWHM6EkH3a8jCZctTJm6ODno4wYoLqqP6AHhSliIT/IjjuRdgq:x4Aw3a8jgcee5Y1qPxHhk/5gq
TLSH
T11D06E021FE1B046AD47FC6B846EA5B28627838EFC75063EB02B41660BEE74F54D749C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sysctrl.pdb

kernel32

GetCurrentProcess GetLastError GetNativeSystemInfo LoadLibraryA GetDiskFreeSpaceExA GetTickCount HeapSize GetProcAddress GlobalMemoryStatusEx CloseHandle LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW FreeLibrary WriteFile RtlPcToFileHeader DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime FindNextFileW TerminateProcess GetProcessHeap HeapFree HeapReAlloc lstrlenW WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx SetFileInformationByHandle FlushFileBuffers DuplicateHandle WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CreateFileW CreateEventW GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose GetConsoleMode GetFileType SetEnvironmentVariableW GetFullPathNameW GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess WaitForMultipleObjects ReadFileEx SleepEx ReadFile CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetCurrentThreadId GetExitCodeProcess

advapi32

RegOpenKeyExA RegCloseKey

user32

GetWindowTextA EnumWindows

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

NtReadFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtWriteFile

Name

.text

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

advapi32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic