2026-06-28_3cc99f81653293c27dadb4f8d78fe6a2_akira_icedid_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_3cc99f81653293c27dadb4f8d78fe6a2_akira_icedid_rusty-stealer
Size 15.9MB
Sample260628-267dfaf181
SHA256 e5d9d1b5f59d9e89ac2e3402d5d8db072ba9e29ae44667eaa932cf31746d1753
MD5 3cc99f81653293c27dadb4f8d78fe6a2
SHA1 8e9cacb98d02173b4b2c073a5f3cab36273cacdc
SHA512 f5b2d806d0d0576510bdc1b459cdd373fa679b9d97a17eb963285aacfc56a3d694fce2e5fc550ec8eafdc11b72e514141717a34310006078ffffb99b245ba407
SSDEEP 24576:7WoaS4AJ6LH0jIidt+XKJ8p9XAIiq7ZkcodKWavlwM4OAvJus:KoafGnj8aJ8pVALsZvplwzY
TLSH
T173F6AF0277BDF0DAE6AB87F4856426518623FC770ED1D49B318C108ACF9B9507EBC2A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_3cc99f81653293c27dadb4f8d78fe6a2_akira_icedid_rusty-stealer

File Explorer

2026-06-28_3cc99f81653293c27dadb4f8d78fe6a2_akira_icedid_rusty-stealer

.exe 15.9MB

2026-06-28_3cc99f81653293c27dadb4f8d78fe6a2_akira_icedid_rusty-stealer

IMPHASH 6675922d0de6b3909c50d21cb84e77d8
SHA256 e5d9d1b5f59d9e89ac2e3402d5d8db072ba9e29ae44667eaa932cf31746d1753
MD5 3cc99f81653293c27dadb4f8d78fe6a2
SHA1 8e9cacb98d02173b4b2c073a5f3cab36273cacdc
SHA512 f5b2d806d0d0576510bdc1b459cdd373fa679b9d97a17eb963285aacfc56a3d694fce2e5fc550ec8eafdc11b72e514141717a34310006078ffffb99b245ba407
SSDEEP 24576:7WoaS4AJ6LH0jIidt+XKJ8p9XAIiq7ZkcodKWavlwM4OAvJus:KoafGnj8aJ8pVALsZvplwzY
TLSH
T173F6AF0277BDF0DAE6AB87F4856426518623FC770ED1D49B318C108ACF9B9507EBC2A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

agent_41b0f136.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

RegOpenKeyExA GetTokenInformation OpenProcessToken RegCloseKey

kernel32

LCMapStringW HeapSize CompareStringW CloseHandle GetCurrentProcessId GetLastError GetCurrentThreadId VirtualAlloc VirtualProtect VirtualFree QueryPerformanceCounter QueryPerformanceFrequency SetLastError GetOEMCP GetVersionExW GetCurrentProcess GetStartupInfoW GetTickCount GlobalMemoryStatusEx GetSystemInfo GetModuleFileNameA GetSystemTimeAsFileTime Sleep DeleteFileA WaitForSingleObject FreeEnvironmentStringsW GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime GetEnvironmentStringsW TerminateProcess GetStdHandle SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetEnvironmentVariableW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileType GetModuleHandleW GetModuleFileNameW GetModuleHandleA FindNextFileW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile RtlPcToFileHeader LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead

shell32

ShellExecuteA

user32

GetDesktopWindow GetSystemMetrics GetMessageTime GetCaretBlinkTime GetCursorPos GetDoubleClickTime GetSysColor

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_3cc99f81653293c27dadb4f8d78fe6a2_akira_icedid_rusty-stealer

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

shell32

user32

ntdll

generic