2026-07-27_44641b20e4e31fddc3f9960d4481dbdb_akira_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_44641b20e4e31fddc3f9960d4481dbdb_akira_cobalt-strike
Size 3.9MB
Sample260727-fdaccavhpg
SHA256 b162b5914688d94778183f043b647961297ec9cc0adfbf14ef1e348509b16dd4
MD5 44641b20e4e31fddc3f9960d4481dbdb
SHA1 313e50285d08d2c3897a376b321765ea200e6879
SHA512 194e1f43c2dc01a09e550d6d9c062169e0fb0a35f7785bf1bea47e6edc228a438c945b9d36927b6b80ad65d8db48605cba2e91ae47c7c948f4589740712dceb5
SSDEEP 98304:2/BngfMxGFYfyVhXwEY6dnlPaSmCIsWcqUhJFE1d8q:agkxKY6XXDTnvI+qQTQ
TLSH
T18716F15361054A9EC217D53AC1A6623A7236B3883731EFFB1C8C5E39FE42ADA4F09754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_44641b20e4e31fddc3f9960d4481dbdb_akira_cobalt-strike

File Explorer

2026-07-27_44641b20e4e31fddc3f9960d4481dbdb_akira_cobalt-strike

.exe 3.9MB

2026-07-27_44641b20e4e31fddc3f9960d4481dbdb_akira_cobalt-strike

IMPHASH 21d5fae2923dd7d978d74dfd737573d6
SHA256 b162b5914688d94778183f043b647961297ec9cc0adfbf14ef1e348509b16dd4
MD5 44641b20e4e31fddc3f9960d4481dbdb
SHA1 313e50285d08d2c3897a376b321765ea200e6879
SHA512 194e1f43c2dc01a09e550d6d9c062169e0fb0a35f7785bf1bea47e6edc228a438c945b9d36927b6b80ad65d8db48605cba2e91ae47c7c948f4589740712dceb5
SSDEEP 98304:2/BngfMxGFYfyVhXwEY6dnlPaSmCIsWcqUhJFE1d8q:agkxKY6XXDTnvI+qQTQ
TLSH
T18716F15361054A9EC217D53AC1A6623A7236B3883731EFFB1C8C5E39FE42ADA4F09754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

kernel32

AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateHardLinkW CreatePipe CreateProcessW CreateSymbolicLinkW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeProcThreadAttributeList IsDebuggerPresent LoadLibraryExA LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReadFile ReadFileEx RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnlockFile UnmapViewOfFile UpdateProcThreadAttribute WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

mscoree

CLRCreateInstance

ntdll

NtCreateFile NtOpenFile NtQueryInformationProcess NtReadFile NtSetInformationThread NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ole32

CoCreateGuid CoInitializeEx PropVariantClear PropVariantCopy

oleaut32

GetErrorInfo SafeArrayAccessData SafeArrayCreate SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear VariantCopy

propsys

PropVariantCompareEx PropVariantToBSTR PropVariantToBoolean PropVariantToDouble PropVariantToInt16 PropVariantToInt32 PropVariantToInt64 PropVariantToUInt16 PropVariantToUInt32 PropVariantToUInt64 PropVariantToVariant VariantToBoolean VariantToDouble VariantToInt16 VariantToInt32 VariantToInt64 VariantToPropVariant VariantToUInt16 VariantToUInt32 VariantToUInt64

userenv

GetUserProfileDirectoryW

ws2_32

GetHostNameW WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv recvfrom select send sendto setsockopt shutdown

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _exit _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

724KB

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_44641b20e4e31fddc3f9960d4481dbdb_akira_cobalt-strike

api-ms-win-core-winrt-error-l1-1-0

kernel32

mscoree

ntdll

ole32

oleaut32

propsys

userenv

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

generic