2026-07-27_8dfdbf247add372440a36485f3fb5fab_akira_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_8dfdbf247add372440a36485f3fb5fab_akira_cobalt-strike
Size 2.3MB
Sample260727-brmsdatfmg
SHA256 bd3ab56f2d56032d7ed9665bc42eac365943e80cb70ae2d7a1a1e2f32cb4c284
MD5 8dfdbf247add372440a36485f3fb5fab
SHA1 ce2eaa5aad7cc7c64e7c8b26787414aeef84eecb
SHA512 6728cd1fbf98f0d94257daec97be85efe094f374b659d4f973ee61b0b4ce1ccacc74cd124b2f3516122bb11ac40f561e0edab1f14dd34f629a43cd8dcd92bf82
SSDEEP 49152:p+cB3XbGc3P45Q2P+i/si3nyvITsz6rIO17/ZqNIZ7878r+9Mm18hq:UcBnp/yQ2rsRQaEIg7RqNIZi18hq
TLSH
T1C3B5BF5362155A5EC267D539C26A623A7236B3883331EFFB0C8C5E39FE429DA4F09714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_8dfdbf247add372440a36485f3fb5fab_akira_cobalt-strike

File Explorer

2026-07-27_8dfdbf247add372440a36485f3fb5fab_akira_cobalt-strike

.exe 2.3MB

2026-07-27_8dfdbf247add372440a36485f3fb5fab_akira_cobalt-strike

IMPHASH 21d5fae2923dd7d978d74dfd737573d6
SHA256 bd3ab56f2d56032d7ed9665bc42eac365943e80cb70ae2d7a1a1e2f32cb4c284
MD5 8dfdbf247add372440a36485f3fb5fab
SHA1 ce2eaa5aad7cc7c64e7c8b26787414aeef84eecb
SHA512 6728cd1fbf98f0d94257daec97be85efe094f374b659d4f973ee61b0b4ce1ccacc74cd124b2f3516122bb11ac40f561e0edab1f14dd34f629a43cd8dcd92bf82
SSDEEP 49152:p+cB3XbGc3P45Q2P+i/si3nyvITsz6rIO17/ZqNIZ7878r+9Mm18hq:UcBnp/yQ2rsRQaEIg7RqNIZi18hq
TLSH
T1C3B5BF5362155A5EC267D539C26A623A7236B3883331EFFB0C8C5E39FE429DA4F09714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsDebuggerPresent LoadLibraryExA LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

mscoree

CLRCreateInstance

ntdll

NtCreateFile NtOpenFile NtQueryInformationProcess NtReadFile NtSetInformationThread NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ole32

CoCreateGuid CoInitializeEx PropVariantClear PropVariantCopy

oleaut32

GetErrorInfo SafeArrayAccessData SafeArrayCreate SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64 PropVariantToVariant VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToPropVariant VariantToUInt16 VariantToUInt32 VariantToUInt64

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _exit _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

724KB

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_8dfdbf247add372440a36485f3fb5fab_akira_cobalt-strike

api-ms-win-core-winrt-error-l1-1-0

kernel32

mscoree

ntdll

ole32

oleaut32

propsys

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

generic