2026-07-10_1411c8a9b2361080abc9e45ddefc4243_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_1411c8a9b2361080abc9e45ddefc4243_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 730KB
Sample260710-cl26jsb17p
SHA256 61497bb8fef9a77ad421d893a0c46dc01e0b17fc3d606c8cb51fac2518f998fa
MD5 1411c8a9b2361080abc9e45ddefc4243
SHA1 72af798a2b9aa6233434b0ab7cf407f1f919c0d6
SHA512 055408de5dd5e5a143b419520e0ef984b3ba2287e119120abdd1328ff93e47ae9af973f176dc2bb5dfe77446a4abfbbd0bcbbeec1720cf9945aed19c2c418eac
SSDEEP 6144:safXgEsxU3+c575FVJO/kNVLxs7t41tPv7UnaT022yAcw5jkVCEjUKTb/UGjldd2:safwdGV7h3AgiyAZ5jYCEjUKPtVGU+
TLSH
T183F43A31B696A7F8E45BC0324605C9231B6134CA0F35ADEBB1D846383F69EF51F39668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-10_1411c8a9b2361080abc9e45ddefc4243_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-07-10_1411c8a9b2361080abc9e45ddefc4243_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 730KB

2026-07-10_1411c8a9b2361080abc9e45ddefc4243_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH a910cdf6098924707d2b9310127b57f0
SHA256 61497bb8fef9a77ad421d893a0c46dc01e0b17fc3d606c8cb51fac2518f998fa
MD5 1411c8a9b2361080abc9e45ddefc4243
SHA1 72af798a2b9aa6233434b0ab7cf407f1f919c0d6
SHA512 055408de5dd5e5a143b419520e0ef984b3ba2287e119120abdd1328ff93e47ae9af973f176dc2bb5dfe77446a4abfbbd0bcbbeec1720cf9945aed19c2c418eac
SSDEEP 6144:safXgEsxU3+c575FVJO/kNVLxs7t41tPv7UnaT022yAcw5jkVCEjUKTb/UGjldd2:safwdGV7h3AgiyAZ5jYCEjUKPtVGU+
TLSH
T183F43A31B696A7F8E45BC0324605C9231B6134CA0F35ADEBB1D846383F69EF51F39668
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5e:c9:8c:82:b7:48:18:34:e6:c8:3f:50:26:45:28:78:b8:9c:a7:46:21:e5:b3:8c:94:83:17:14:87:ab:b0:90

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Software Publisher Certificate

Chains

Jul 9, 2026

CN=Software Publisher Certificate

Subject

CN=Software Publisher Certificate

Serial Number

12:72:f8:c9:5b:7b:a3:a0:4b:ac:ac:d9:69:4e:6e:fd

Issuer

CN=Software Publisher Certificate

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftKernelCodeSigning

Timespan

Jun 10, 2026 - Jun 10, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

404192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mzloader.pdb

kernel32

SwitchToThread LCMapStringW GetLastError HeapReAlloc CreateThread WaitForSingleObject CreateWaitableTimerExW SetWaitableTimer Sleep HeapAlloc SetThreadStackGuarantee GetCurrentThread CreateFileW GetModuleHandleA GetProcAddress CloseHandle RtlLookupFunctionEntry SetLastError WaitForSingleObjectEx LoadLibraryA GetCurrentProcess GetCurrentProcessId CreateMutexA ReleaseMutex CompareStringW HeapFree GetModuleHandleW FormatMessageW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose GetFullPathNameW GetModuleFileNameW GetSystemInfo OpenMutexW LoadLibraryExA GetCurrentThreadId GetProcessHeap AddVectoredExceptionHandler GetConsoleMode SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute RtlCaptureContext RtlVirtualUnwind GetStdHandle GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryW lstrlenW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeW GetSystemTimeAsFileTime GetStartupInfoW RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent IsDebuggerPresent FindNextFileW GetFileType VirtualProtect LoadLibraryExW HeapSize FlushFileBuffers SetFilePointerEx InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection UnhandledExceptionFilter SetStdHandle GetCommandLineA GetCommandLineW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegEnumKeyExW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

oleaut32

SysFreeString SysStringLen

winmm

waveOutGetNumDevs

Name

.text

Size

507KB

Virtual Size

507KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.sc

Size

1024B

Virtual Size

731B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_1411c8a9b2361080abc9e45ddefc4243_akira_cobalt-strike_icedid_rusty-stealer_satacom

PE Signature issue

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

oleaut32

winmm

generic