2026-07-14_b0602009332862eca2960ecd0e2b64a6_akira_cobalt-strike_icedid_rusty-stealer_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_b0602009332862eca2960ecd0e2b64a6_akira_cobalt-strike_icedid_rusty-stealer_satacom
Size 687KB
Sample260714-drfeeads2m
SHA256 c01f900aaee0b8cd692a3ae0fcd7153beeafd463cb392098d1f3b2f1770f33d6
MD5 b0602009332862eca2960ecd0e2b64a6
SHA1 56c7c5d0b046c87eefd9a69975814d0d7b107fcd
SHA512 48770d494b024daa8844a74dbf507bf827e45bbd5e3707f54046bccd748918ea0c28e876d8bb9cead511fd9ab8b947469f6d448430cda6ad54fdfede83f3c05d
SSDEEP 12288:8l6cGW7+TBdq0KplKVTErIYHvR+PdcEEUmFfE:5c8k0elWQIYHvu
TLSH
T1C8E44B06FA9548BCD04AC87482468F56AB3274D71B26EADF0389022C3F6E7F55F39764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_b0602009332862eca2960ecd0e2b64a6_akira_cobalt-strike_icedid_rusty-stealer_satacom

File Explorer

2026-07-14_b0602009332862eca2960ecd0e2b64a6_akira_cobalt-strike_icedid_rusty-stealer_satacom

.exe 687KB

2026-07-14_b0602009332862eca2960ecd0e2b64a6_akira_cobalt-strike_icedid_rusty-stealer_satacom

IMPHASH f5c3adb6ceb0cdaba407b7f60ec077c6
SHA256 c01f900aaee0b8cd692a3ae0fcd7153beeafd463cb392098d1f3b2f1770f33d6
MD5 b0602009332862eca2960ecd0e2b64a6
SHA1 56c7c5d0b046c87eefd9a69975814d0d7b107fcd
SHA512 48770d494b024daa8844a74dbf507bf827e45bbd5e3707f54046bccd748918ea0c28e876d8bb9cead511fd9ab8b947469f6d448430cda6ad54fdfede83f3c05d
SSDEEP 12288:8l6cGW7+TBdq0KplKVTErIYHvR+PdcEEUmFfE:5c8k0elWQIYHvu
TLSH
T1C8E44B06FA9548BCD04AC87482468F56AB3274D71B26EADF0389022C3F6E7F55F39764
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

377744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

lockdown.pdb

kernel32

CompareStringW CreateProcessA SetFileInformationByHandle VirtualProtect GetCurrentThreadId CreateFileW GetModuleHandleW GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetFullPathNameW SetLastError GetCurrentProcess FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose UnhandledExceptionFilter IsDebuggerPresent CreateToolhelp32Snapshot Process32First OpenProcess TerminateProcess Process32Next AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapReAlloc IsProcessorFeaturePresent GetCommandLineW GetCommandLineA HeapSize GetModuleHandleExW WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader FlushFileBuffers RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP AcquireSRWLockExclusive WaitForSingleObject ReleaseSRWLockExclusive MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter CreateThread ExitProcess GetTempPathW CreateWaitableTimerExW SetWaitableTimer LCMapStringW GetModuleFileNameA SetFilePointerEx Sleep LoadLibraryExW GetProcAddress GetLastError GetModuleHandleA HeapFree OutputDebugStringW OutputDebugStringA GetModuleFileNameW GetFileAttributesW LCIDToLocaleName GetUserDefaultUILanguage FreeLibrary LoadLibraryW CloseHandle SwitchToThread

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

user32

DispatchMessageA EnumChildWindows PostQuitMessage GetSystemMenu ShowWindow GetClipCursor GetActiveWindow ToUnicodeEx GetKeyboardLayout GetMessageA GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect PostThreadMessageW ValidateRect GetRawInputData SetWindowLongW ReleaseCapture SetCapture SendMessageW MapVirtualKeyExW GetMenu EnableMenuItem IsProcessDPIAware GetWindowLongPtrW AdjustWindowRectEx GetDC MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage TranslateAcceleratorW GetAncestor GetKeyState GetAsyncKeyState PeekMessageW DefWindowProcW ClipCursor GetMonitorInfoW SetCursor LoadCursorW MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW CloseTouchInputHandle GetTouchInputInfo GetWindowRect GetKeyboardState MonitorFromRect ScreenToClient SystemParametersInfoA TrackMouseEvent DestroyWindow DestroyAcceleratorTable RedrawWindow PostMessageW DestroyIcon CreateAcceleratorTableW SetMenu InvalidateRgn SetWindowPos SetWindowDisplayAffinity MapVirtualKeyW RegisterTouchWindow GetSystemMetrics IsWindow RegisterClassExW EnumDisplayMonitors RegisterRawInputDevices GetMessageW SetWindowLongPtrW CreateWindowExW SetWindowsHookExA EnumWindows ShowCursor SetForegroundWindow FindWindowA IsWindowVisible GetWindowTextW CallNextHookEx SendInput RegisterWindowMessageA

advapi32

EventRegister EventSetInformation EventWriteTransfer EventUnregister RegOpenKeyExW RegQueryValueExW RegCloseKey GetTokenInformation OpenProcessToken RegSetValueExA RegDeleteTreeA RegCreateKeyA RegGetValueW

comctl32

DefSubclassProc SetWindowSubclass RemoveWindowSubclass

gdi32

GetDeviceCaps DeleteObject CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow

ole32

RevokeDragDrop CoInitializeEx CoUninitialize RegisterDragDrop CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree OleInitialize

shell32

DragFinish SHAppBarMessage DragQueryFileW

ntdll

RtlNtStatusToDosError NtWriteFile

uxtheme

SetWindowTheme

oleaut32

SysFreeString GetErrorInfo SysStringLen SetErrorInfo

Name

.text

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_b0602009332862eca2960ecd0e2b64a6_akira_cobalt-strike_icedid_rusty-stealer_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

advapi32

comctl32

gdi32

dwmapi

ole32

shell32

ntdll

uxtheme

oleaut32

generic