2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 22.2MB
Sample260517-k55d1set2z
SHA256 f35197b644c011f3c8eee56f7f7cac4d304d1f404e9659324d08a7b77073116d
MD5 fdda91a46440d8f2724f0f64568cb4d1
SHA1 cd2eacad050b9fddedf3f48d8d7299e712c5fb63
SHA512 5309876a776556a95e3666ecb99fa70f51f56eca90bdc70cfe462d3cdaae071eac8b9253ce561043217e9ea746f84b95b7ba625a712e4684faba6f8914bc2d62
SSDEEP 393216:FOhBizwodxJyOfqs1kGaRUXLDkIx9BdNo7jn:FLnJu8VkITloX
TLSH
T1FA371519E253CF6E187713E055251FFCAEEE714E6A6A2647D0F9E24332E606C85BF840
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 22.2MB

2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH 48eac30b1657e046e9ce443a4cd38db0
SHA256 f35197b644c011f3c8eee56f7f7cac4d304d1f404e9659324d08a7b77073116d
MD5 fdda91a46440d8f2724f0f64568cb4d1
SHA1 cd2eacad050b9fddedf3f48d8d7299e712c5fb63
SHA512 5309876a776556a95e3666ecb99fa70f51f56eca90bdc70cfe462d3cdaae071eac8b9253ce561043217e9ea746f84b95b7ba625a712e4684faba6f8914bc2d62
SSDEEP 393216:FOhBizwodxJyOfqs1kGaRUXLDkIx9BdNo7jn:FLnJu8VkITloX
TLSH
T1FA371519E253CF6E187713E055251FFCAEEE714E6A6A2647D0F9E24332E606C85BF840
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b4:45:91:13:6e:fc:8b:65:96:48:f3:5c:11:bf:f5:19:bc:fd:b2:9f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DocConverter Suite

Chains

May 13, 2026

CN=DocConverter Suite

Minor OS version

Major OS version

Entry point

610344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

docconv.pdb

kernel32

GetLastError FormatMessageW CompareStringW LCMapStringW HeapAlloc GetTimeZoneInformationForYear HeapSize CloseHandle GetStdHandle GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetLastError GetConsoleOutputCP VirtualProtect WriteConsoleW FlushFileBuffers HeapFree LoadLibraryExW GetProcessHeap VirtualAlloc LoadLibraryA HeapReAlloc SetFilePointerEx FreeLibrary GetStringTypeW GetCurrentProcess LoadLibraryExA SetConsoleTextAttribute GlobalMemoryStatusEx GetSystemInfo SetEnvironmentVariableW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetSystemTimePreciseAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetACP WaitForSingleObject MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW QueryPerformanceCounter CreateThread GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess GetModuleFileNameW GetCommandLineW GetTempPathW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep GetFileType IsValidCodePage GetProcAddress FindNextFileW EncodePointer SetStdHandle GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter

ole32

CoInitializeEx CoCreateFreeThreadedMarshaler CoGetObject

oleaut32

SafeArrayPutElement SafeArrayCreateVector SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement VariantClear SysAllocString SetErrorInfo GetErrorInfo SysFreeString SysAllocStringLen SysStringLen

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

shlwapi

SHCreateMemStream

advapi32

OpenProcessToken RegCloseKey RegSetValueExW RegOpenKeyExW GetTokenInformation

shell32

ShellExecuteW

Name

.text

Size

660KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-17_fdda91a46440d8f2724f0f64568cb4d1_akira_cobalt-strike_icedid_rusty-stealer_satacom

PE Signature issue

kernel32

ole32

oleaut32

api-ms-win-core-winrt-error-l1-1-0

ntdll

api-ms-win-core-synch-l1-2-0

shlwapi

advapi32

shell32

generic