2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom

General

Target
2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 3.2MB
Sample260704-vqaafaat81
SHA256 71faa19d55772e9454eb747f6325535f4ae25c21f146e9addc2438ca05b37eb6
MD5 d990e3335bca7f7aa3f93fd7d34cd8ee
SHA1 29a2184d4688f0b2387bf4ccab55b77ef6e6f3b5
SHA512 323c8c41c8e118597b26c968e5e9ca0e7a016bba364be9e6e2d4abaa4660868a52b249c061bcef1bbe79c9e7b5b3c8b8565fa0d542ad24657d5363aea0ff3ca7
SSDEEP 49152:x7FB7BplKQ8Y+Bi6v1vZRM0d7IqnJUOKtC5Nm:RgFDJ7FBJUntC5
TLSH
T150F5E024C7995972D829D03C48864BDE4735ED4ACE8117CF13EC25B08C861EEADFA6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 3.2MB

2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH af6d96fb29de416aeb6ddb74faa00a55
SHA256 71faa19d55772e9454eb747f6325535f4ae25c21f146e9addc2438ca05b37eb6
MD5 d990e3335bca7f7aa3f93fd7d34cd8ee
SHA1 29a2184d4688f0b2387bf4ccab55b77ef6e6f3b5
SHA512 323c8c41c8e118597b26c968e5e9ca0e7a016bba364be9e6e2d4abaa4660868a52b249c061bcef1bbe79c9e7b5b3c8b8565fa0d542ad24657d5363aea0ff3ca7
SSDEEP 49152:x7FB7BplKQ8Y+Bi6v1vZRM0d7IqnJUOKtC5Nm:RgFDJ7FBJUntC5
TLSH
T150F5E024C7995972D829D03C48864BDE4735ED4ACE8117CF13EC25B08C861EEADFA6DE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

182912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stage0.pdb

kernel32

GetProcessHeap HeapReAlloc LoadLibraryA HeapFree GetProcAddress CloseHandle WaitForMultipleObjects GetOverlappedResult GetLastError WaitForSingleObject GetExitCodeProcess AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW GetFullPathNameW GetModuleHandleW FormatMessageW GetModuleHandleA WriteFileEx SleepEx ReadFileEx CreateEventW CancelIo ReadFile CompareStringOrdinal GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateFileW CreateThread SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtReadFile NtCreateNamedPipeFile NtOpenFile NtWriteFile

Name

.text

Size

233KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

generic